we don't want our clients to even know the address of the server, much less it's design and contents...
Well, using this then you application is limit to only certain server. You may need to use another server in the future (ie. in case your original server is down).

To implement security in component you need to use Microsoft Transaction Type Library (mtxas.dll). This allow you to check the user name, password, role... So even if you know the user name, password then you need to know roles as well before you can hack into the component.

Regards,
TheBao