CiviCRM Community Forums (archive)

If you trust the people having access to civicrm and they use strong passwords, it should be ok. However, beware that if you need some users having access to civicrm but that can't access all the contacts or this or that, the access rules are easier to be worked around.

In short, your main line of defence (beside SSL) is the "access to civicrm" rule (I'm assuming you're on drupal). If you can live with the limitation that whoever has access to civicrm can probably access most of the content knowing that whoever hasn't can't access anything, that's should be ok.

This being said, something online is probably always easier to get access to that the files you lock in your safe, and you should focus on security training (what to do with the passwords, where (not) to store them, never give your password, even if this is the "tech support" guy that asks, protect access to your email account...). I wouldn't assume the social workers (or any human being) having access to your civicrm are really that good about online security.

X+

We have SLL support from our host but how vulnerable is data stored online?

Security on your server is only as good as your host. SSL is a security risk, without question. Allowing remote MySQL access is also a security risk. Even with these disabled, there is always a risk that your FTP or sFTP passwords can be compromised by a virus on your local machine. This can and does happen.

My professional opinion is that while there are certainly risks, they can be minimized (SSL and remote MySQL access can be disabled) and the rest is a function of your host. If you feel you can rely on the host, then I feel it's acceptable to store sensitive data online. There is of course no guarantee, but I think the risks are small enough to outweigh the benefits of using a system like CiviCRM.

@hershel,

Are you saying ssl is a security vulnerability and should be disabled ? Confused, I'd say the opposite.

Oh, my. Yes, you are quite right. I mean to write ssh not ssl. Seems my comment is actually somewhat irrelevant as the OP didn't even mention ssh. I misread his original post.

My mistake.

Several sites using CiviCase for politically sensitive or personal / medically sensitive issues do keep their CiviCase/CiviCRM install separate and on a VPS. One of them (Physician Health Program British Columbia) also uses a Crypto-key Token integrated with Drupal login for extra security:
http://civicrm.org/node/541

Actually the Physician Health server that runs civicrm/civicase is a dedicated server not a VPS.
There is also a VPS for the public / informational web site.

So yes there is a cost to separating those two types of data, either the large modification like you say or by purchasing separate server offerings. In your case maybe you could do two VPS's?