The cloud computing introduced security risks which make companies reluctant to adopt it. Some means exist for reducing these risks while deploying a business process (BP) in the cloud. Among them, a technique largely used is to split the BP model in a choreography of BP fragments so that a cloud has only a partial view of the model. Unfortunately, reducing security risks with this approach implies the increase of BP fragments and of hosting clouds, and corollary the increase of costs. To overcome this issue, we present two heuristics managing separation/co-location constraints for risk versus cost optimization: the first optimizes the risk while respecting a cost threshold, the second optimizes the cost while respecting a risk threshold. These heuristics are experimented with a risk model, whose characteristics is to use only client-side data, and a more traditional cost model. Finally, the heuristics are validated against an exact optimization solution.