You can encrypt data on your side and only decrypt it when your users sign in. This is the approach SimpleTax uses in Canada.

Send me an email and I'll be happy to go into more detail. (I'm on a plane which is hopefully taking off soon, so I don't have time to write more right now.)