We honestly don't know what to tell them. In fact, we are unsure of what we ourselves should be doing. We know that there are risks of keeping things local (e.g. lack of redundancy), and there are risks of data being stored beyond your control. At least with an outsourcing contract you can review the security and privacy issues, but with cloud services, you're stuck with boilerplate.
For years we've hoped for two developments to solve these problems: