The database should be encrypted, regardless of the information it stores (see #3 for some discussion).