How to securely store Bitcoin server-side?

I am working on a web application that needs to hold users Bitcoin for an extended amount of time (escrow-like scenario), and I was wondering what are some good steps/precautions and principles (dos & dont's) to do this securely. This is mostly in regards to security, so things like individual vs single server-side wallet etc. My thoughts thus far is that I probably should not have all the eggs in one basket, so something like generating a new random wallet per transaction server-side, and encrypt the private keys with a two-way algorithm before they are stored in the database, perhaps combined with user password so given the encryption function ENCRYPT(password,data) it would be: ENCRYPT(HASH(hard-coded password+user password+random salt+pepper), private key).