DB2 is a full featured database-engine as are Oracle and SQL-Server. The Express-C has limitations on RAM-size (16gb) and number-of-cores (2). Those limitations might impact your application, but you posted no numbers about your database metrics. DB2 authentication (of userid/password) is done either by the operating-system or centralised-authentication (ldap, kerberos...) and the SQL syntax follows ANSI SQL standards mostly which could mean changes to your application. So it's not only a matter of speed or security but the cost to migrade both the code and the data, and the long term support issues.