Security Configuration and Programming Guidance
CiviCRM is a good system if you want your data to remain secure. I would recommend installing on a hardened server following the normal instructions, and ensure you keep the security patches for your CMS and CiviCRM applied when they come out. Drupal, WordPress and Joomla! all have security announcement lists you can subscribe to. See https://civicrm.org/security for CiviCRM's.

During configuration you will want to ensure that the permissions are configured to prevent inappropriate access to data (eg see http://wp46.demo.civicrm.org/wp-admin/admin.php?page=CiviCRM&amp;q=civicrm%2Fadmin%2Faccess%2Fwp-permissions&amp;reset=1 after logging with user demo password demo). For example, CiviCRM: view all contacts and CiviCRM: edit all contacts should be reserved to Administrative users, and CiviCRM: skip IDS check should be disabled for all users (IDS is Intrusion Detection System).