The right answer. With a design that focuses on simplicity ( reducing the entry points ) you can be pretty well assured that if someone attempts to gain access to your data you will likely know.

For me that is an important factor. I rather dislike the fact that in scenarios like Gmail and other providers of their ilk -- access is provided transparently to a third party.

Running your own server can give you a reasonable expectation of privacy. Even in a hosted/colocated environment if you take the time and effort.