Regardless, my concern is still there and I will still refuse to use it. To each his own, I'm not trying to campaign against them, just sharing my opinion.
Another point that I originally excluded, but which I think is relevant on a different front, is that y'all are limiting your customer base with your setup. I'm sure you're well aware, and perhaps it's something that you'd like to do eventually or perhaps you've investigated it and it's not economically viable, but there are likely many apps that could well use something like this, but can't.
For instance, the app that I work on for my day job is PCI & HIPAA compliant, and we've had to roll our own solutions for many features due to the fact that our app is intranet-hosted, aka. 100% insulated from the internet. Even if our app was internet-facing, trusting an outside vendor with sensitive data is non-starter, unless they are also PCI/HIPAA complaint, as is any solution that has the capacity for such data to leave our app.
But again, thanks for the reply and I wish you the best of luck!