We may be "total control freaks " but since our application stores Protected Health Information (http://en.wikipedia.org/wiki/Protected_health_information , except our requirements are even more strict), given our budget constraints and very good talent availability we're rolling our own, starting with buying the motherboard, CPU and 1U enclosures on up. Using the Xen XCP system as a good "just works" distribution of Xen, not as it was intended (a pool of multiple interchangeable hosts). Aren't messing with incoming email and stuff like that, companies that specialize in that sort of stuff are OK and decrease our attack surface.