DevOps - Server expert - Security expert

POINT #1 - Security enhancement
Audit on the current level of security of the database
Audit on the current level of security of the interaction between the website & the database
Report/Proposal of actions to implement to foster global security (achievable)
Once connected on MariaDB, the data (even the ones from clients) are not encrypted and readable by all persons that have access to MariaDB - we would like to avoid it and to make sure that the person that has access to the database would not be allowed/capable to read the data.
Replication of database frequency/ Physical and/or could servers (duplication/business continuity plan)
Put in place restriction on the databases access thanks to a VPN system

POINT #2- Python script

We might integrate some Python scripts in the mid-term. Those scripts should be saved and run on dedicated servers I guess? We would like to know if the scripts can be run on the existing servers or if we need to add another server as well? Is it safe to keep those scripts on the same servers as the Symfony code etc?

POINT #3- business continuity plan
The current servers are saved on OVH once per week (replication) - to avoid any loss of data, we are wondering if the database should be saved more regularly*
if the database should be saved on another physical source as my personal computer benefiting from enough Hard-Drive (+external Hard-Drive) on a daily basis for instance

POINT #4- WAF and/or IPS and/or NGFW setup
please advise us in regards of the best protection to implement between the 3 mentioned ones
please setup ********/ if the solution is relevant for our project

POINT #5- Long term support