I am currently creating a database that contains sensitive data such client names, addresses, etc. I have never worked with the setting up of servers but my research tells me to either use a cloud service or to have it completely harddrive stored on my pc. How secure would it be to store it locally?
Databases - especially if they contain sensitive data:
- Should run on dedicated servers (either bare metal or VMs)
- Should not be directly accessible from the Internet (protected by firewall, etc.)
- Should not run on the same host as other network services, and especially file sharing services or web/application services
- Should not run on the same host as any other service that accesses the Internet, other than the minimal connectivity required to download patches for the OS
The configuration and securing of a database server is a highly complicated task about which many, many, many books have been written. The specifics will depend on which database engine you are using; the specific options for that database that you are licensed to use; the operating system the database will be running on; the type of application that will be accessing the database; the network architecture supporting that connectivity; the type of data being stored; high availability requirements; legal security obligations or requirements; and potentially a whole host of other factors that will need to be discussed and planned at a high level with administrators, architects, and developers before a single line of code is written.
Also note that securing the database infrastructure (storage, networking, encryption, software, OS, etc.) is entirely different than secure application design and the implementation of data security in the database using roles, masking, and other application level business rules.
Bottom line here is that if you don't already have experience doing this, you should find someone with experience to guide you through it, and not rely on this forum for all your questions. If you don't have access to someone like that, then using a cloud service that handles most of those details for you is probably the best way to go.