In my opinion, for security (not privacy... though you might argue they are too interconnected, in which case open source is first) you should trust: large companies > open source > small companies.
Large corporations typically possess substantial resources for security audits, compliance frameworks, and incident response, bolstered by reputational incentives to maintain trust. Open-source software offers transparency, enabling community-driven code review, though its security depends on the project’s maintenance and the expertise of its contributors. Small companies often lack the resources for comprehensive security measures, though exceptions exist.
Just a general idea, it's not going to be true all of the time, but its the safer bet.