Live records. Sign-in checks a password and locks an account after five failed attempts. Multi-factor authentication is not built yet, so a stolen password is enough on its own — and there is no encryption at rest. Keep the backups tested and off this machine.