There are several popular approaches to this.
First, is getting an independent, 3rd party auditor to vouch for you. This is most effective if it is done by a well-known name (e.g. get Troy Hunt to vouch for you, or Charlie Miller if you're on Apple's OS), or a huge household name (if your target market are non-technical / non-security folk) - e.g. E&Y, or Accenture.
Taking this a step further, you can get accredited by a 3rd-party regulation or certification. This is possibly the most popular, and IMO likely the least effective.
This could range from PCI-DSS (which you would have to do anyway if you handle credit cards), through to the infamous "HackerSafe" (I think its called "McAfeeSECURE!!1!" now). Either way, it doesn't actually show any real quality, and in some cases is easily spoofed. cough cough
There is a third option, which is much more difficult to do right, but a lot more effective particularly with those that most understand what this means. This option requires two steps:
- Actually being secure, and having a strong process to ensure this;
- Sharing details of that process, and what it actually entails.
Being secure is a much wider question and out of scope of this answer; sharing the details is obviously much less common in big corporates, though I am starting to see this in more startups and even larger, but technical, enterprises.
This could include information about your SDLC; explanations of your security requirements; technical details about your implementation; possibly an open bug bounty, but at least a statement of response to researchers (and follow through!); maybe even opensourcing your codebase, if relevant; and so on and so on.
Obviously you would need an experienced security expert to help you get your application to be secure; a very good one could help you "open the kimono" in a productive, yet secure, manner. Done right, this could even increase marketing efforts, and still not reveal any sensitive details that could help an attacker bypass your controls.
Interestingly often old-school security pros (especially those with a corporate background) will insist on not revealing anything; but not only should this not at all increase your risk or attack surface (if done right), it can definitely help allay any potential customer fears or worries, especially if they understand what they're reading.
Just make sure you have someone who knows what they're doing.