Came across this post by accident. Bert, you're saying that the database could be accessed directly, thus bypassing logons,encryption, and the audit log?