Confidential data and documents should be stored on redundant, isolated, secure databases and web servers. Also, the physical copies should be stored in a secured room under surveillance with access controls.