I have an IWP solution where customers are going to be entering delicate info such as credit card numbers. I have all IWP connections auto signed in under the [guest] account. I have set all sensitive fields (such as CC numbers) to be global fields. This should make it so that no one can see the data entered by an outside user unless they are connecting from the same IP since global fields are user specific (I have tested this). Also, when the user disconnects from the database the record they were using is deleted. Is there any flaw in this? Short of masking an IP address during the time a user is connected, is there any way someone could get access to that sensitive data being entered?

If I'm not mistaken, IWP does not use encrypted protocols (i.e., https); consequently, the data will not be secure between the client machine and the server. That would be my main worry.

David