Do: use the banking centers data center. Let them take on the burden of physical security. They need to provision something with their IT infrastructure for compliance. Until it's in their environment, just host locally on an encrypted drive with dummy data.
Don't: use any cloud environment. Use a dedicated, managed host. Let the client foot the bill.
Do: double-check on the pg_crypto library's best practices and check out this word for word.
Do: read in general about key pairs, salts, and hashes here: https://dba.stackexchange.com/questions/35296/database-encryption-and-key-management-with-pg-crypto
Do: add some authenticators like security questions and allow automated detection of suspicious behavior like logging in from new IP, double-blind customer service verification (customer service cannot see the answers, they only type in the customers security challenges and see if it passed or failed at end)
Do: periodic security audits. Suggest outside firms to assist you and pad your proposal with the added cost. A small e-commerce operation (just talking about signing up for online ed, and paying for it for ex.) costs about $5,000 to audit yearly by a recognized firm.
Do: read up about MITM attacks. Prevent out of date browsers, or self-signed certs from ever using the site. Prefer to use a highly trusted CA and never allow wildcard certs, express certs, or out-of-date certs on server side. All that is your job to do! Congrats on the RFP and good luck.
More to come.