So you mean a self-hosted solution? What is inherently unsafe about it?
If they sold the software maybe you could host it on-site, but having this on centralized servers with many other companies is incredibly risky and generates a huge target.
An effort to break into a large cloud company storing thousands of interesting accounts has a bigger payout. Attempts to attack such a service will be made more often and with more sophistication than attacks on a smaller company only having one set of potentially interesting secrets.
If your company really values its corporate info so much, it likely already has policies and expertise to secure its own servers. If not, maybe a cloud instance is safer.