Nathan -
Yeah, that's what I was wondering. However, we have 3 GIS users and there is no way that our company is going to buy us a server. AGO just seemed so promising.
The three potential solutions I see so far are and none are ideal, two allow the data to just be out there:
1) Not searchable, but public. Accessible via AGO by login (Organization) or by specifically shared link.
2) Not searchable, but public. Accessible via AGO by login (Organization) or by password protected link.
3) Not public. Have some user level so that each client has their own organizational login to the products made for them but we would not be charged for each one of them as a separate user. No reason we'd buy a 200 user license if only 3 of us are actually using the product and the other 197 are just viewing products.
It turns out that if you don't put important (i.e. logically searchable) tags into your tags your item will most likely not be found except by those with whom you've shared the link.
However, any maps, applications etc you make will show up in that most recent maps section of the home page - meaning someone can scrape that page and get anything they want. It's not that I think that there is some malicious person out there scraping for important data but that it can be done. And our clients do not want their confidential information out there.