Data protection

We're working to release an online directory service for clubs/organizations. Seeing as how our application is all about managing personal data (photos, names, addresses, phone numbers, birthdays, etc.), I have two data protection questions for the HN community.

1) How does the security of application hosting services (e.g., Pagoda Box, Heroku) compare to the security of virtual machine hosting services (e.g., Amazon Web Services, Linode)? With virtuals machines, we may be on shared hardware, but we're running an operating system managed by our own team (e.g., minimal account access, restricted firewalls, up to date patches). With application hosting services, I'm not sure how much security, or even between-account application and database separation, to expect.

2) I've read through several of the HN discussions around data protection and compliance. I've also read about data protection requirements for consumer marketing data, financial transaction data, and health services data. Since we're not storing consumer marketing data, financial data, or health services data, which of the other standards out there would apply to an online directory service? Do we just err on the side of "the more secure, the better," and choose PCI or HIPAA compliance?

Thank you!