[eurasiantiger]

The application has a much larger attack surface than the auth/user system, so it makes sense to store PII separately.