Keeping record cards

Hi,

I know I need to keep client record cards locked away, but where do you keep yours? I was thinking of a lockable box but then they can be easily picked up and stolen?

Thanks