Safer to whom?
In a TCP connection one of the two parties needs to open a set of ports and leave it open for others to connect to. In your situation it sounds like you're trying to determine who has the risk of hosting the server. (you vs them)
I would say leave the server hosted at whomever has the most experience in managing servers.
Hosting a server (HTTP, FTP or anything else) requires patching, and verifying the username/password. If you're a large site, protection from DDoS attacks is important and this adds to the responsibility of whomever hosts the server.
If there happens to be a bug in the server software, then you open up your internal network to hackers, and so this server should be placed in a DMZ. (note: That doesn't mean server-less network isn't immune to hackers, it just limits the ways they can get in.)