Atlassian, the makers of JIRA and Confluence, give you a choice: host on your own hardware, or let Atlassian host the apps for you:

Should you self-host, or go with Atlassian Cloud hosting?

It is worth considering for a moment how unique this is. The industry has moved strongly to a SaaS, subscription model. Companies love it when they have your data, a steady income stream, and lower support costs from supporting essentially just one environment. Virtually every new product management app these days is SaaS-only. SaaS is often good for customers too. No more hassle of maintaining and upgrading software.

So why do we strongly recommend self-hosting? A few reasons.

More Plugins (aka Add-ons)

JIRA and Confluence have a thriving plugin ecosystem, visible at https://marketplace.atlassian.com.

Plugins are why you can't go wrong with JIRA and Confluence: you're not just buying a product, you're buying into a platform upon which hundreds of companies are madly building and making lots of money.

The dirty secret is this: most plugins don't work on Atlassian's Cloud-hosted version. Here are logarithmic graphs showing plugins by popularity (as per marketplace.atlassian.com stats), excluding unmaintained plugins incompatible with the past 3 releases.

Blue plugins are self-hosted only, red are cloud-ready, and yellow are cloud-only.

There is not a lot of red.

Things are improving for Cloud customers. Atlassian is pushing it's new cloud-compatible 'Connect' plugin framework, and in the 2015 Summit, Mike notes that Cloud-compatible plugins have grown from 50 to 300 in a year. If you consider only the top 50 plugins, the situation looks better:

However, given that:

• migrating a plugin to the Connect framework requires a complete re-architect
• Connect plugins are severely limited in what they can do
• Connect plugins require a vendor-hosted component, putting a burden on the plugin vendor

it seems likely that outside the money-making top 50, the "long tail" comprising the vast majority of plugins will never be Connect-enabled.

More Integration Possibilities

This applies especially to Confluence. Your wiki does not exist in a vacuum.

• Want to reuse user accounts for your corporate Active Directory or LDAP? No can do, though to be fair, Cloud-hosted does offer Google Apps integration.
• Got other SQL databases? By running JIRA and Confluence, you already have two. Did you know that Confluence makes an awesome ad-hoc reporting platform? Have a look into the SQL, PocketQuery, and Play SQL plugins for Confluence, and Database Values and Arsenale Dataplane plugins for JIRA. For instance, let's make a live 'Top 50' chart from a plugin stats database, using Pocket Query:
  

  Invalid license

  Your license for maintenance of PocketQuery is not valid for version 8.5.6. Please contact an administrator to renew your PocketQuery license.

  
  This is only possible if you self-host.
• How about embedding HTML or Javascript, e.g. an iframe of your latest build results, or widgets on the web
  

More extensibility

• The second most popular JIRA plugin, ScriptRunner, is not available for Cloud. Script Runner (aka Groovy plugin) adds a fantastic degree of extensibility to JIRA. One can script up new custom fields, new behaviours (e.g. show field X if field Y has this value), run arbitrary code on workflow transitions, expose custom REST endpoints, and so forth. 
• The whole wonderful world of Confluence user macros is denied to Cloud-hosted customers. User macros are a powerful mechanism whereby administrators can create custom wiki macros, such as the Timezone macro above.
• There is no customizing Confluence appearance with themes, either via simple tweaks or via complete custom themes (such as this website).
• No custom HTML in JIRA or Confluence (particularly useful embedded in JIRA field descriptions).

Avoid lock-in

With self-hosted, your data is yours:

• With self-hosted, your data behind the company firewall, on your own domain name ( CLOUD-6999 - Getting issue details... STATUS ) With Cloud, your instance is public at a https://yourcompany.atlassian.com URL, no 2FA, not even restricted to an IP range ( CLOUD-2636 - Getting issue details... STATUS ). You are one guessed password, zero-day exploit or fat-fingered permissions mishap away from being compromised. Atlassian have a good security track record, but still issue frequent security advisories. It would be naïve to believe hackers don't have a few more up their sleeves. If your Cloud-hosted site was compromised, would you ever know? You have no access to the server logs, and Atlassian won't know or care if hundreds of requests start coming from China.
• With self-hosted, Atlassian licenses are perpetual. If one day you decide to never upgrade JIRA or Confluence again, you never need to pay Atlassian another cent. With Cloud-hosted, you will be paying Atlassian forever.
• With self-hosted, you get to decide when maintenance is done. You decide when to upgrade to the next release, rather than being on the bleeding edge.

Note that it is possible (with some effort) to move from self-hosted to cloud, and cloud to self-hosted.