Since I don't have to be PCI-compliant, it's doubly important that the company I'm trusting to handle my customers' data is doing their job right. It'd be irre

Since I don't have to be PCI-compliant, it's doubly important that the company I'm trusting to handle my customers' data is doing their job right. It'd be irresponsible NOT to ask. A small, three-guy startup running on Linode with little to no background in payment processing or security doesn't automatically win my business.