What database and security setup should I use for my first small workplace web app?

Be cautious about putting an untested system into someone’s workplace. Authentication, authorization, privacy requirements, auditing, and data recovery are much harder than they first appear, especially if the information belongs to the company or contains personal data. It would be better for the employer to approve and fund the project, or at least review it before anyone relies on it. You can build a prototype and test it with dummy data first, but don’t treat it as production-ready until security and backups have been properly reviewed.

HTML alone cannot build this kind of application; it only defines the page structure. You’ll also need programming logic, such as JavaScript in the browser and possibly a server-side language. For a single-device project, a local database such as SQLite could be a reasonable starting point, but you still need reliable backups. Keep multiple copies in separate locations and test that you can restore them.

You’ll need to decide whether the application is entirely local or whether it should run on a server. In a traditional client/server design, the browser talks to your application server, and the server handles the database and business rules. This generally gives you better control over validation, permissions, and security than allowing the browser to interact directly with the database. Cloud services can simplify deployment, but they still require careful authentication, authorization, and backup configuration.