One of the Spreedly cofounders is a PCI expert, and we're building the application with PCI compliance in mind. Security's a big deal for us, and for now we're focused on the practicalities of being secure rather than the (expensive, time-consuming) trappings of being certified as secure. We'll definitely get our gold sticker eventually, but not quite yet. In the meantime, we have a constant focus on security and spend regular time looking at the platform through that lens.