In this era of privacy, why would I list such important information with you? I see your track record, but I'm fairly certain this data you store (however encrypted) and ask users to enter or connect to your systems sits somewhere closer to medical PII in value than a massive trove of mail from a smaller operator in the space.

This seems like you're building an extremely high value target on the back of successes of handling data of a lower value tier no matter how wonderful everything is, and success only grows the bounty. I don't need to hear that it won't happen, I need to see how I'm already protected should the worst come to pass. If all you can offer is best practices and no disaster plan that makes me better off than whole, I can only give you my best wishes for your future instead of a $10/month place at my table.