They have a reassuring security page[0]. It's nice to see they're enforcing good practices, I especially appreciate their "no-link email policy" where they will never send you links in emails, which seems like a great way to head off phishing attempts. I hope they actually present this to users in some way during sign-up though, or it won't be of much help unless a user manually navigates to the security page and reads through most of it.
I'm a little disappointed that they only have level 2[1] HSMs in the cloud, as I would be uncomfortable protecting my hot wallet keys with only tamper evident protections, rather than level 3+ that actually attempt to detect intrusion and delete keys. Bitcoin makes for very quick stealing once you have keys, so reactive defenses against key loss don't help much as you're literally in a race condition with the attacker to empty the wallet (you into a non-compromised one, the attacker into their own). But I would assume they weighed cost/risk and I've never heard of a security compromise of Amazon's HSMs so it was probably a reasonable choice.
edit: I should also applaud their use of PGP and (explicit) respect for responsible disclosure.