>the business rules is the "heart" of the business , and this format is no secure, this issue not matter?
>
>only my .02

It's no more secure or insecure as any other data-driven business rule. If security was a real concern, you could easily move the XML up to SQL server and have your application pull the information down when it started or on an "as needed" basis. If you were using local tables, you've got the security of local tables (ie. none). That might mean you'd need to employ some sort of encryption scheme. It really depends on how secure things need to be.