"any slip up in their security"? We aren't talking about storing plaintext passwords in a database here. They should be storing and sending/receiving encrypted

"any slip up in their security"? We aren't talking about storing plaintext passwords in a database here. They should be storing and sending/receiving encrypted data only. It would most likely be necessary to compromise the client in order to gain access... in which case it makes no difference whether you're using a cloud-based service or not.