It won't be very fun to make, but the architecture should support column level controls for sure. Row level I'd have to look into in more depth. Right now we already have a system for hiding columns from specific tables where they aren't needed, and it's not just hiding them frontend, the column data isn't queried. We can probably hook into that.

That's a good point, the report builder doesn't support OR at the moment. The interface for that should be interesting.. We may just allow custom SQL queries and be done with it. We definitely plan to get into BI/analysis, I'll check those out.

We backup and log literally everything. The user actions aren't shown to Organization admins yet, but that's only because we haven't built a frontend for it. We're working on showing a list of actions taken by connected users. All changes to forms and submissions are also diff logged, and you can reset to any older version. The frontend for that has some minor bugginess that I'm working out, though.