Hi newman314, we've consulted with Heroku's security team and implemented all the best practices suggested by them. We started enforcing a password complexity policy for all of our accounts (Heroku, Amazon, codebase, database, etc). We got an upcoming blog post on security planned in which we will inform you much more on how we keep your data safe. Stay tuned!