The most important thing is to store all user coins via multi-signature cold wallet. This wallet does not have physical internet access and requires at least two persons to execute the transaction in question. This method was proven effective by BitMEX, who have zero lost coins so far.
Additionally, our internal instruments are isolated by our corporate network. Meaning that nobody from outside will ever gain access to our administration.
Of course we don’t store user information in plain data format — everything is secured, including hard drive encryption.