Are we storing the credentials on DB? Or at least, are we storing them unencrypted?