Also you should be able it encrypt the datbase, for another layer of security. I maybe wrong but don't pasword recovery apps have to be run locally?

If so, strong security on access to the machine hosting the database would seem to be a good idea,

Jinxy