Thanks! I suppose the answer depends on what you mean by "plainly in the cloud" :) It is indeed stored in Amazon's RDS, which is a managed service. I approached this as a real product rather than a weekend project when it comes to security (application and infrastructure) and there is a lot in place protecting the data - Firebase's jwt auth, XSS and SQL injection protection, default passwordless logins, data encrypted at rest, database in private subnet, DB credentials in a secrets vault with automatic rotation, multi-factor auth for all of my access to infra, probably a bunch more. Are there specific concerns not addressed here?