We're SOC2 compliant which has been enough for many companies to get comfortable with security / data handling practices.