A few good answers already covering the technical aspects of what you are concerned about - I won't reiterate those. Ultimately, in the event of a "security breach" you need to consider the legal recourse you have. What are the terms of the license, to what extent are they responsible for damages you suffer as a result for service failure etc. For your specific case, can the damages be recovered in cash. You also need to consider how secure your alternate is. Is an in-house server, presumable connected to the internet, any less likely to be compromised than Github? Are you skilled enough and putting the require resources into your installation to be certain?
I am working with an organization looking at putting data in the cloud - however, there data , although having limited commercial in value, is legally sensitive. No amount of cash damages would fix a security breach. As a result, their measure of secure is "more secure than running in-house systems". This is followed with legal jurisdiction - the provided must answer to the same legal system - in our case, same country, as they would fall under same laws regarding data security, privacy etc, and a breach is likely to be answerable in criminal, not just civil courts. Cross border legal disputes are to be avoided at all costs, as are cross border criminal complains.