I have experience developing software and web applications and I have decided to do some freelance work on the side. Well, I met with my first client and they are requesting a relatively simple, custom system that (without being long winded) tracks clients paperwork as it progresses through the businesss different manual processes.  It is a small business that has about 10 employees, but all of the employees will interact with the clients paperwork, therefore everyone would need access to the new system. When I say track I literally mean that the employees will check as complete on a simple page the increases a progress bar at different stages for the paperwork.  Now I am %110 capable of coding the custom system that meets their needs, but I am unsure about how I should go about doing it.The information that is being tracked in the new system and stored in the DB is confidential information that they are very protective of. My main question is how should I be developing this to be as secure as I can?They have their own server in house, so should I develop an application (VB and SQL) for the server and require employees to log on remotely to use it? Can more than one person access/use the application at a time?Or should I develop a web application (ASP.Net/VB and SQL) that is only accessible on their network to their employees? They plan to expand offices, could they set up a VPN to access the site?Im leaning towards a web application, but I have not done too much in term of security. What specific options do I have for security that aren't too complex.   Basically Im looking for pros and cons for either option or any suggestions on what I should.
VB stand alone application or ASP web application
asp.net;security;web;applications;visual basic