Centralize test-data:
I like to put test-data into Class objects and not in text-files. This way you can use proper code completion for your test-data. Centralizing test-data from "strings" is a must, you do not want to change hundreds of "strings" when changing test-data.
Encryption of test-data:
Encryption of test data should be a company policy, but adds extra complexity. If the test environment is not world reachable and the accounts are test specific, than personally I do not care for encryption. Most encryptions are reversible if you have the code, so you need a encryption framework that works on all your test-agents, but cannot be decrypted if someone steals the code. I would really wonder if you need this.
Better is to just generate test users on the fly for your test. This way you can use random passwords only for that tests. This removes the need to encrypt any data. A user class object could create the user on first usage. Preferable use the same user creating logic as the application uses. Then you can store the password only in memory :)
Cross-browser:
Extend when needed, use YAGNI and do not over complicate your framework if you do not plan to test on multiple browsers now. My current project is Chrome only. So we only test on Chrome. I am fine with refactoring the tests if we need to support another browser later. We might never reach that state so let's first get a market-fit for our internal reporting tool instead of focusing on supporting all browsers, probably we never will.
there must be a configuration file.
So there must only be a configuration file if you need it now! :) Developers have a hand of I know we will need this, because other projects.. bla bla bla. Don't make up requirements based on past knowledge, it is a possible waste and I cannot repeat this often enough.
If you do need to test on multiple browsers as a requirement, start with adding one in a early stage of your framework and try to make it flexible. Code it in such a way you can inject another a browser later if needed. For example with an parameter from the command-line or a config file. Your tests should not be browser aware, so no IF CHROME
blocks.
Documentation:
Yes, you do need basic documentation how to install, run and usage your tests. Seems logical. You make software for other humans not computers.