I'm a security person. I have a non-profit that wants to use CiviCRM. What are the nitty-gritty details that I need to know? I will handle the hard technical stuff for them. The only information of value they are trying to protect is user real name and email address. But, they are considered very sensitive and high value. No money is exchanged with users. Their activity history is not considered sensitive, just the fact they are associated with the site. There will be millions of users and high site visibility.