Things like building-access-codes don't need to be kept on a "live" database. If a customer places an order, the key-access-code for that specific customer can be copied from nearline storage to "live" storage well before delivery, then deleted after delivery is complete.
This way, if the "live" database is completely compromised, only the relatively-few customers who have pending or very-recently-delivered items will have their key-access-code data stolen.
A similar principle can apply to the customer's contact and billing information and for that matter all information not needed to login in: only have it available to the "live" system when it's needed.
If a customer decides he wants to review his account information, give him a screen that says something like "it will take 5 minutes to retreive your data" then put a count-down timer in the corner of the web page. Use that 5 minutes to load the data from nearline storage.