Their security page [1] needs some work: apparently they "use SHA 256-bit encryption across all of our solutions" and "your personal account information is never compromised". SHA-256 is a hash algorithm, and it's not very clever of them to state that users' PII is never going to be compromised. Someone with an ounce of computer security knowledge needs to rewrite this page, quickly.