If you haven't considered it, I'd strongly encourage you to look into client-side encryption. Lawyers have various opinions on it, but with what various governments are doing these days, storing data in a way where the service provider can't read it would be a big selling point for an industry that deals in confidential information.