>>I built one from the ground up using simple MYSQL tables for users, groups, privileges, etc and about 150 lines of PHP code.
>>The maintenance is done with a .NET app that's super secure.

>>The particular app that uses it has more than quadrupled in volume (and revenue) during the past year and my client stole two mammoth fortune 50 clients, because of what it offered to them, from competitors more than 5 times my client's size who couldn't react because of their sclerotic environments.

Sounds like you did a great job! We also rolled our own security, but most recently we try to rely on AD with group membership determining what they can access. Very windows-centric though I suppose you could use Ubuntu or Centos with Webmin just as easily.

Who accesses the app? Does the browser ever leave anything in %temp% or internet cache? Do they ever view pdfs or files in your apps? If so, the browser can leave trails of content. Probably not so important if all users are inside a firewall and/or there isn't federal legislation obliging every scrap of identifiable footprint to be scooped up...