VB stand alone application or ASP web application

VB stand alone application or ASP web application

I have experience developing software and web applications and I have
decided to do some freelance work on the side. Well, I met with my first
client and they are requesting a relatively simple, custom system that
(without being long winded) tracks client's paperwork as it progresses
through the business's different manual processes. It is a small business
that has about 10 employees, but all of the employees will interact with
the client's paperwork, therefore everyone would need access to the new
system. When I say 'track' I literally mean that the employees will 'check
as complete' on a simple page the increases a progress bar at different
stages for the paperwork. Now I am %110 capable of coding the custom
system that meets their needs, but I am unsure about how I should go about
doing it.
The information that is being tracked in the new system and stored in the
DB is confidential information that they are very protective of. My main
question is how should I be developing this to be as secure as I can?
-They have their own server in house, so should I develop an application
(VB and SQL) for the server and require employees to log on remotely to
use it? Can more than one person access/use the application at a time?
-Or should I develop a web application (ASP.Net/VB and SQL) that is only
accessible on their network to their employees? They plan to expand
offices, could they set up a VPN to access the site?
I'm leaning towards a web application, but I have not done too much in
term of security. What specific options do I have for security that aren't
too complex. Basically I'm looking for pros and cons for either option or
any suggestions on what I should.