The fact that personal and financial data will be hosted on your company servers, tying names and accounts to Bitcoin transactions and wallets, all doesn't pass the smell test, if the code isn't open for inspection.
Of course, there is nothing preventing your company from putting up placebo code on Github, that doesn't actually represent what is running on your servers. I understand that, but as a show of good faith, it would do your company more in the long term by opening the code in addition to providing an API.
Anyway, good luck.
We're trying to be as secure as possible — personal data is strongly encrypted in our database, we're using tokens instead of bank details to keep things more secure, we're implementing 2FA for logins, and we're using perfect forward security for SSL.
Unfortunately, though, money laundering law mandates that we need to record personal information so there's little we can do to get around the name <=> bitcoin address issue. We have ideas (like company-specific encryption for bitcoin addresses where only employers can decrypt addresses) but it's a long way out, even if we do implement it.