When implementing forms solutions we use the JCR purely as an intermediary location for data we need to move around or reverse replicate. If you are collecting PII inside your forms, you need to take a direct to DB approach. Specifically the SubmitDataService. You can implement custom code to ensure your data is sent to an encrypted data source. This also makes reporting and extraction easier for the enterprise.