These are valid points. Enhanced security will always have a price, and in the Database world, that equals response time. If security is that important to your organization then I would approach it like most other problems, do everything you can to tighten up the code then make up for the rest by scaling up. In this case since Disk IO is the potential bottleneck, I would consider implementing a Solid State SAN. There is no seek time to speak of and the randow reads are the same as sequential reads. As far as transmitting the data, SSL on ASP pages does pretty well, again performance is just a matter of how much you want to spend.