I am sure you are aware of this, but for anyone who works with data or use cases that are at all sensitive, this is, or at least should be, a crucial requirement, both because it is common sense and good practice, and because there is a large and vociferous privacy community that is just waiting to jump on companies that ignore privacy protection. One of the first things I did at my last PM job was to move us to https.