Seems like if you just disclose and make assurances that "you take security seriously" then it's fine.