Since I don't have to be PCI-compliant, it's doubly important that the company I'm trusting to handle my customers' data is doing their job right.

It'd be irresponsible NOT to ask.

A small, three-guy startup running on Linode with little to no background in payment processing or security doesn't automatically win my business.