Security questions in DPA 6.x

We are currently planning to install DPA and have a few questions that so far EMC have not been able to answer, I was wondering if there was anyone here who might be able to!

Firstly our security team have a big concern about the need to give SSH access through certain firewalls for monitoring Data Domain; they want to know where the credential is stored (presumably in the database but not 100% sure of this) and how secure this is (plain text, encrypted etc).  If there is a certificate where is it stored?

Secondly we plan to use AD for authentication but we also need to provide details about roles and groups and how they work; we currently expect to have two groups of users who will be in specific AD groups and I believe this will simply map to the role we want in DPA.

Anyone able to give some advice?

regards

David