Hierarchical encryption of data

A non-transitory machine readable medium storing a program which when executed by at least one processing unit causes the at least one processing unit to perform operations, the program comprising sets of instructions for:

• storing a separate encrypted structure for each of a plurality of data assets on a cloud services platform, wherein a first key provides access to each of the encrypted structures;
• storing, on the cloud services platform, a folder structure with an encrypted copy of the first key;
• storing a parent structure of the folder structure on the cloud services platform, the parent structure comprising an encrypted copy of a second key that provides access to the encrypted copy of the first key;
• adding to the folder structure a second copy of the first key that is encrypted with a third key associated with a user account, responsive to a request to share the plurality of data assets;
• and
• removing the second encrypted copy of the first key from the folder structure responsive to a request to remove the user account from a list of user accounts with which the plurality of data assets are shared.

An electronic device comprising:

• at least one hardware processor;
• a non-transitory machine readable medium storing a program comprising sets of instructions for:
• storing a separate encrypted structure for each of a plurality of data assets on a cloud services platform, wherein a first key provides access to each of the encrypted structures;
• storing, on the cloud services platform, a folder structure with an encrypted copy of the first key;
• storing a first parent structure of the folder structure on the cloud services platform, the first parent structure comprising an encrypted copy of a second key that provides access to the encrypted copy of the first key;
• receiving input to move the plurality of data assets in the folder structure to a second parent structure;
• removing the encrypted copy of the first key from the folder structure;
• and
• adding a second encrypted copy of the first key to the folder structure, wherein the second parent structure comprises an encrypted copy of a third key that provides access to the second encrypted copy of the first key.