The media files are all stored in the Amazon S3 cloud (Ireland) and only accessed via ssl.
The data is held on AWS instances in Ireland and is provisioned using mongodb cloud manager. The data is backed up every night and on weekly and monthly rolling schedules. All communication with the databases is via SSL. The data is not encrypted at rest, but you don't need to upload any sensitive information beyond an email address - and these emails can be dummy emails. All passwords are encrypted using bcrypt.