Can't you install docker compose on your own hardware and follow this? https://snikket.org/service/quickstart/

You can use upstream apps instead of their forks, as I do. Zero problems.

It is simply Prosody + Conversations + Siskin [1], so I'd say that many people have had their eyes on their code.

Specific security audits would have to be searched for, though.

[1]: https://snikket.org/open-source/