Apologies if this in the wrong section, not sure if it should go in Server Fault or not.
I am preparing to launch a new web app. We have put a lot of effort into offering good security. From a PR perspective, I need to mention some of what we are doing - security is a fundamental part, and selling point, of this project and details will be expected.
So, my question is, how much do we give away without compromising our security. Do you bang on about fw/proxies, nids, hids, honeyd, compartmentalised architecture and watchdogs etc, or just "we're PCI compliant".
I should point out that a fair number of the users, especially early doors, will be security conscious and knowledgable; does being "PCI Compiant" cut it?