I would say the key question is 'who cares about your data the most?'. Do you want someone who's only concern is ticking enough boxes in order to get paid and not sued or someone who passionately cares about the data?
You are the only person who values the security of your data. cheers, oshwm.
