Configuring an application to run in Secure Mode is not enough to ensure security. Several security measures outside of the custom application need to be taken, both on the server that runs ITP/OnLine and on the ITP/Server installation.