I'm not sure about all security-related aspects of it, but concerning a separation between application logic and data, unhosted[1] comes to mind.

[1] http://www.unhosted.org