[miika]

If security is top priority, to me it starts from deciding what kind of data actually needs to be stored. Then the service is designed from that perspective.

More sensitive data I need store, more I need to think about security as well (and more expensive it gets).

If it's obvious that the service doesn't have much worth of hacking for, it's already better starting point than if I know it's going to be hack attraction.