BowTieXP Enterprise normally uses Microsoft’s ASP.NET Core Identity cookie-based authentication and enforces HTTPS (TLS) for secure transmission. Alternatively, you can use Windows authentication (if all your users are in a domain), Azure Active Directory, or OpenID Connect.
The latter three allow for more complex authentication scenarios (such as single sign-on and two-factor authentication). How the database is secured is up to the IT department of the customer doing the deployment. We recommend using an encrypted database connection between BowTieXP Enterprise (in IIS) and SQL Server. Server configuration and hardening are also up to the IT department of the customer.