I'll take the N4 off your hands if it's too complicated. Anything actual sensitive such as PCI, etc should be prevented server side from ever reaching your phone, which leaves only communications via e-mail, mms, sms, etc. or attachments that are sent through unapproved channels, ie. breaking either company policies and/or regulations of that data. Best advice would be to take the device to your security team with your specific concerns and they should be able to address best practices.
In the really real world, the iPhone is 100% exactly the same security level as any Android phone sold through retail/carrier channels in the US (including the N4) (as in, not a knockoff from the 3rd world). Their security is 100% up to the user. If you follow best practices and avoid malware, unauthorized peripheral access and unauthorized network connections, + setting the security settings built in on the phone to their most restrictive settings, in most cases it would take someone physically having your phone to "crack" it, and even then, there would be nothing of use on it.