Amen. You can also declare those stored procedures SECURITY DEFINER and deny access to the underlying tables to the client role for much Better security. For example if you have a table of users with login and hashed password, a check_login stored procedure allows checking password but if(when?) the app server gets compromised, the attacker can't even dump the list of valid logins because they don't have SELECT privileges on the table.