it leads me to here: Is encrypting passwords in protected custom settings a security requirement?
Which includes this segment:
Ensure that sensitive information is not available to all users in a customer org. This can be achieved by using Custom Settings in "Protected" mode, and creating a Visualforce page for authorized users to update information. The previously stored data should not be displayed back to the user on this page. Another option is to implement Apex Crypto and store the encryption key in a protected custom setting. For more information see the Secure Cloud Development entry for Storing Secrets.
Having read all that, I don't know what a protected custom setting record is. Are we talking about an Apex class, or something I store in a database somewhere?