Ask HN: “Blackboxing” an on-premises application

I had a discussion today with a friend of mine who’s tasked with delivering an on-premises installation of their web app to a “BigCo” (think server-side web app + a SQL database).

Now, the database actually contains some proprietary data (which is the biggest concern). The worry is that once the client gains access to the system (it’s gonna be installed on a client’s server), they can extract the “trade secrets”, so to speak.

What would be the most efficient way to complicate direct access to the data? It’s clear, as long there’s direct access to the hardware, there’s pretty much no way to restrict access as such. The question is in increasing the difficulty of doing so.