I don't quite understand SSL — because donations are processed via PayPal, does that mean the transactions are secure? Or should my client invest in a certificate?

It depends on which PayPal you're using. For PayPal Pro, it is critical that you have SSL (users are entering credit card info on a form on YOUR site). For PayPal Express and Web Payments Standard all credit card info is entered directly on SSL secured forms on PayPal's servers. Check the documentation at CiviContribute Payment Processor Configuration . [Source. ]