I am busy converting a web application to MVC and have some information saved to Application variables used across multiple tenants/accounts to make things a bit more effici
Session state or the Cache are better choices. They are mockable in MVC and are designed to store session and application-scoped data.
Static classes seems like a popular choice here. However static classes create dependencies between your types and make versioning/testing harder. Its also a bit of an odd pattern to use in a framework that is designed to break apart these kinds of dependencies. For instance, the standard ASP.NET framework is riddled with statics and sealed types. These are all replaced with mock-able instances.
"Secure" is a bit unclear in this context. Exactly what do you mean by "secure?"