Our organization is building a Drupal web platform that we aim at reselling as a cloud service. In order to provide our customers with maximum confidence in our solution, we're looking at ways of publicly conveying trust regarding the quality and security of our platform. Here is what we came up with some far:
-Drupal: are there any Drupal certifications available out there?
-PHP: have your PHP developers certified (e.g. Zend PHP certification) and display the certification image (ideally, create links from the About/Team/Dev page to a page on the zend website where this could be verified).
-SSL: buy certificates from sizable CAs (e.g. Verisign) instead of cheaper and not as known ones (e.g. prontossl.com) and display the CA seal on your website accordingly.
-System: have your system penetration tested by a known security company, have a case study written about it.
-Infrastructure: get your infrastructure ISO QMS 9001 certified.
-HTML/CSS: show that your company is doing everything it can to remain standard-compliant by making your code W3 compliant and showing the W3 valid icons on your website.
-Misc: get your engineers to pass some security certifications, like one of these.
Are there anything else you can think of that could help promote the quality/security of your platform?
PS: if you're planning on answering with a "what really matters is the actual quality/security of your solution more than how good/secure it appears to be" type of answer please refrain. We all know it's true, but we also know that from a sales standpoint, it is very important to be able to rely on certifications to efficiently promote quality/security.