A properly secured in-house environment has the potential to be more secure that a service provider arrangement.

The service arrangement adds additional and fully disclosed interfaces by which to access data and behaviors.

The service arrangement also adds network traffic across external links.

An in-house application has fewer potential points that invite attack.