Protecting documents using policies and encryption

A system comprising:

• a document management system, wherein the document management system manages a plurality of documents wherein the document management system comprises clients and servers;
• a first client, coupled to the document management system, wherein the first client executes a first interceptor code component;
• a second client, coupled to the document management system,
• wherein at the first client, intercepting by the first interceptor code component a transfer request by an application, the transfer request executed at the first client, to perform a transfer of a document, managed by the document management system, to the second client,
• by the first interceptor code component, transferring handling of the intercepted transfer request to a first policy enforcer program,
• using the first policy enforcer program, evaluating at least one policy associated with the document,
• as a result of the evaluating, determining that the transfer request is allowed, but before allowing the application to perform the transfer of the document, encrypting the document,
• allowing the application to transfer the encrypted document to the second client,
• receiving the encrypted document at the second client,
• at a second interceptor code component, detecting an attempt to open the encrypted document at the second client,
• by the second interceptor code component, transferring handling of the detected attempt to open request to a second policy enforcer program,
• at the second policy enforcer program, evaluating at least one policy associated with the encrypted document, and
• as a result of the evaluating, determining that the open operation is allowed;
• an encryption module executing on the second client, wherein the encryption module determines the encrypted document is encrypted, and
• at the encryption module, attempting to obtain a key for the encrypted document by sending a key request to the second policy enforcer program including information comprising a process identifier;
• and
• an encryption service, wherein the encryption service identifies the application program attempting to access the encrypted document at the second client,
• from the encryption service, sending identification information on the application program to a policy enforcer component, executing on the computing device,
• controlling access to unencrypted content based on the first policy comprising:
• identifying a first application process identifier assigned by an operating system executing on the computing device for the application program, wherein the application program is attempting access to the encrypted document,
• receiving a decryption key based on the first application process identifier at the encryption service,
• using the encryption service to decrypt the encrypted document to produce the unencrypted content,
• providing the unencrypted content to the application program, and
• allowing a first system level operation to execute.