Tenant level encryption

A system for at least one of encryption and decryption of data, comprising:

• at least one hardware processor executing a code for:
• accessing data for at least one of encryption and decryption, wherein the data is of a user account of a plurality of user accounts;
• obtaining an account key in an encrypted state, the account key is obtained from an account key dataset storing at least one encrypted account key for each of the plurality of user accounts;
• providing over the network, the encrypted account key to at least one key management system (KMS) hosted by a server;
• receiving over the network, a decrypted account key from the server hosting the at least one KMS, wherein the at least one KMS decrypts the encrypted account key using an organization key stored and managed by the at least one KMS;
• storing the decrypted account key in a data storage device set to provide temporary storage for decrypted account keys;
• at least one of encrypting and decrypting the data associated with the user account using the decrypted account key;
• generating the account key for the user account, wherein the account key comprises a new account key for the user account;
• providing over the network, the new account key to the at least one KMS, wherein the new account key is in a decrypted state;
• receiving over the network, at least one encrypted versions of the new account key, each respective encrypted version of the new account key created by the at least one KMS using a respective unique organizational key stored and managed by the KMS;
• storing the at least one encrypted versions of the new account key in the account key dataset in association with the user account;
• detecting at least one of an error and a security breach of one of the encrypted versions of the new account key;
• and
• in response to the detected at least one of error and security breach, using another of the encrypted versions of the new account key;
• wherein the at least one encrypted versions of the new account key provide redundancy for the account key;
• wherein the at least one of error and a security breach is detected in response to attempted decryption of the encrypted account key.

A non-transitory medium storing program instructions for at least one of encryption and decryption of data, which, when executed by a processor, cause the processor to:

• access data for at least one of encryption and decryption, wherein the data is of a user account of a plurality of user accounts;
• obtain an account key in an encrypted state, the account key is obtained from a key dataset storing at least one encrypted account key for each of the plurality of user accounts;
• provide over the network, the encrypted account key to at least one key management system (KMS) hosted by a server;
• receive over the network, a decrypted account key from the server hosting the at least one KMS, wherein the at least one KMS decrypts the encrypted account key using an organization key stored and managed by the at least one KMS;
• store the decrypted account key in a data storage device set to provide temporary storage for decrypted account keys;
• at least one of encrypt and decrypt the data associated with the user account using the decrypted account key;
• generating the account key for the user account, wherein the account key comprises a new account key for the user account;
• providing over the network, the new account key to the at least one KMS, wherein the new account key is in a decrypted state;
• receiving over the network, at least one encrypted versions of the new account key, each respective encrypted version of the new account key created by the at least one KMS using a respective unique organizational key stored and managed by the KMS;
• storing the at least one encrypted versions of the new account key in the account key dataset in association with the user account;
• detecting at least one of an error and a security breach of one of the encrypted versions of the new account key;
• and
• in response to the detected at least one of error and security breach, using another of the encrypted versions of the new account key;
• wherein the at least one encrypted versions of the new account key provide redundancy for the account key;
• wherein the at least one of error and a security breach is detected in response to attempted decryption of the encrypted account key.