Maintaining strict data confidentiality of clients

Question

I am building car rental web-application software

I recently encountered a concern from a possible client; that they don't want the software company to see their data in the database. They load their rates contracts etc which are confidential and don't want anyone apart from them have access to this data, including our dba or some developer/tech person.

I normally do not sell the code of my application and only let clients run the software on their servers. I normally do maintenance and system updates to their servers on a bi monthly or so basis. So I do have remote access to their servers and such. Up to now this was OK, but I move into a market where there is a lot of competition and clients are very anxious about their data and having a server that only they have access to.

They proposed that I sell an exclusive version of the software to them so that they can carry on with maintenance and future updates in-house.

I do consider and brain-storm around business models that can revolve around that idea. But at the same time I think about if it would be reasonable/practical to support/update/maintain an application without accessing the database server directly at all..

Any suggestions appreciated..

Ps: Having a non-disclosure agreement is not enough for this situation.

Answer 1

Do they fully understand what it will take to get someone in their organisation trained to be able to maintain the application?

Make this clear to them.

What happens when an employee of the company who's had access to this information leaves?

This is a more likely source of data leakage.

Offer to sign a non-disclosure agreement which is standard in this sort of case.

Answer 2

Have you thought of Encryption techniques on database side....

Answer 3

You don't need the access to database for application maintenance. You don't have to service the database if they have the staff. If you need to change something in DB you can do it with scripts, or special one-time mini-applications. If they want the database let them have it.