OH: “Encrypting a database, tossing up a generic internet-facing web server, and crossing your fingers is not a strategy.”