I'm not convinced that such a strict approach to securing client data is always the best policy. The clients of 37signals are not the same as the clients of tar

I'm not convinced that such a strict approach to securing client data is always the best policy. The clients of 37signals are not the same as the clients of tarsnap. I would think that a client of 37signals is the sort that sometimes needs the help of an admin and that often that help would require looking at the client data. My own company will never store sensitive data with an outside firm like 37signals but that is only because we have a great IT staff. For companies that don't have an IT staff, outsourcing to 37signals makes sense and is probably worth the tradeoff to trust them with data.