RatticDB is a password manager; it must, by definition, be able to return the raw passwords themselves. From the outside, the role of the password manager is to store the passwords and show them only to duly authenticated entities, so that the stored passwords may be used with third-party systems which are completely unaware of how the passwords are remembered by users.
Encryption is a mechanism which can be used to ensure data confidentiality within certain conditions. In the case of a password management database, the use or non-use of encryption makes a difference only with regards to partial breaches by attacker. Since RatticDB must be able to produce the stored passwords on demand by the right user, a complete hijack of the machine necessarily allows the attacker to obtain all passwords, regardless of encryption. However, if a backup file for the database component is stolen, then encryption matters: if the data was encrypted with a key that was not stolen, then the breach does not reveal the passwords.
From an engineering point of view, RatticDB's stance is understandable: as an application-level piece of code, it may consider that database encryption is best dealt with at the database level, out of the scope of RatticDB itself. Indeed, whether encryption brings benefits or not depends on contextual characteristics such as the local backup policies. A comprehensive database encryption system would be TDE (as implemented by Oracle and Microsoft SQL Server), which is done on the database, regardless of the application.
Another model where encryption could be applied, and would become relevant, would be a password manager which stores only encrypted passwords that the manager cannot decrypt. In a way, this is how most "password wallet" applications work, when included in your browser (e.g. KeePass): data is ultimately encrypted with regards to some user secret (e.g. a "master password") and decrypted right on the user's machine, even if the encrypted passwords are physically stored in another machine. This sort of thing can work only if the client system (the one closest to the human user) is able to do decryption, something which is not a given in a Web context (basically, it needs a browser extension). RatticDB appears to follow another model, which supports dumb clients (Web browsers with no extension).
