Your SSL is wide open to this renegotiation DOS attack https://www.thc.org/thc-ssl-dos/
Disable Secure Client-Initiated Renegotiation or sign up to Cloudflare for their TLS stack and DDOS mitigation as well since I would imagine competitors will start attacking you like they do all payment gateways.

Your address is an apartment building in London.. what physical security precautions have you taken from somebody breaking in and planting keylogging spy equipment to steal that gold mine of bank accounts, private bitcoin keys, and identity documents? I would be running this service out of a makeshift SCIF with access control and intrusion detection.