For what it's worth, the industry in general is trending towards software as a service (supporting your hosted solution option). Take the Salesforce.com success story. Look at their client list and you'll see who is trusting *very* sensitive information with an ASP.
With that said, SFDC has no shortage of money to dump into it's data centers and security policies. So in the end it's the customer perception of your ability to secure their customer data.
Hope that helps.