At the exact moment you take money or personal information from users, you really better have a safety / security first approach and have a defined, repeatable,

At the exact moment you take money or personal information from users, you really better have a safety / security first approach and have a defined, repeatable, scheduled, abortable deploy procedure. Its not number of users, its what its going to cost each user when you screw up.