In QPR Metrics System, all the data is centralized to one place. Only the QPR Server components and the reporting components utilize this database directly. This helps keeping the data secure on the contrary to traditional client-server systems (and on the contrary to any kind of manual scorecarding!), where multiple connections to database might be required - even over the Internet.
Database security is handled with vendor-specific database authentication (username / password combination) via ODBC. Whatever vendor-specific extensions to security can be utilized as long as the system is ODBC-compliant.