So as far as security for email goes you prefer people to outsource to Google Apps or similar rather than likely screwing up and having an insecure configuration?

Just curious what you consider best practices to be in that case.