One of the most often cited reasons that companies of any size say they don't use Software as a Service (SaaS) providers like O4BO is security. We understand that concern and have taken significant steps to ensure their security. One is our partner nCircle (http://www.ncircle.com/).
nCircle's solutions are engineered to work seamlessly in the virtual and cloud environment. This enables both managed security services and business application partners to deliver comprehensive vulnerability and compliance risk assessments in any mix of Cloud, SaaS and on premise configurations.
This is almost completely in alignment withO4BO as we are running on the IBM Smart Cloud Enterprise (http://www-935.ibm.com/services/us/en/cloud-enterprise/), we are offering six applications as and integrated SaaS solution, and with Mule ESB we extend that integration to on premise applications and data. That is I would say an unprecedented synergy, not just a product offering (although we will happily sell nCircle to you whether you subscribe to all our applications or not).
If you are concerned about Security in any SaaS solution, just ask what they do for security? If you find one that has addressed it better than we have, go for it, if not, welcome aboard.