Enumerate all of the methods/protocols/whatever that you employ in keeping our information secure. Most (all?) of the site seems to be behind https, so that's a decent start. Are you PCI compliant? How to you store and encrypt our data? Obviously, you don't have to divulge the secret sauce here, but something more than what the FAQ outlines would be a good start. 37s has a decent go at a security page: <a href="http://37signals.com/security" rel="nofollow">http://37signals.com/security</a>