Our application traffic runs entirely over 256-bit encrypted SSL (https). Passwords are hashed before storing using bcrypt with a cost factor of 10 and application credentials are kept separate from the database and our code base.