Here is a link to the evaluation guide that has some information on the version control server.
You can use the team server provided by Mendix or choose to use your own SVN repository.
Hope this helps!
First of all, find out how serious the security aspects need to be for your company to find the right balance between 100% legally and practically secure and on the other hand unnecessary paranoia.
Mendix V4 is hosted on AWS. See this docs.mendix article.
Mendix V3 was hosted at Mendix, only hearsay, can't find any docs on that to confirm it.