Encryption key management for international data residency

A method for providing encryption key management for international data residency, the method comprising the steps of:

• receiving, from a client device, an indication of a user attempt to access an encrypted message posted in a group-based communication system associated with an organization;
• retrieving, from a first data store in a first geopolitical area, information identifying a storage location of the encrypted message, wherein the information identifying the storage location of the encrypted message indicates that the encrypted message is stored in a second data store in a second geopolitical area, wherein the second geopolitical area is distinct from the first geopolitical area;
• retrieving, from the second data store in the second geopolitical area, the encrypted message;
• responsive to determining that a decryption key associated with the encrypted message is not stored in a key cache in the first geopolitical area, retrieving the decryption key from a key server located in a third geopolitical area,
• wherein the third geopolitical area is distinct from the first geopolitical area;
• decrypting the encrypted message using the decryption key to obtain a plaintext message;
• and
• transmitting, to the client device, the plaintext message for display to the user.

One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by a processor, perform a method for providing encryption key management for international data residency, the method comprising the steps of:

• receiving, from a client device in a second geopolitical area, an indication of an attempt to access an encrypted message posted in a group-based communication system associated with an organization;
• retrieving, from a first data store in a first geopolitical area, information associated with the encrypted message,
• based on the information associated with the encrypted message, identifying a storage location of the encrypted message as a second data store in the second geopolitical area,
• wherein the second geopolitical area is distinct from the first geopolitical area;
• retrieving, from the second data store in the second geopolitical area, the encrypted message;
• retrieving an organization-specific decryption key associated with the encrypted message from a key server located in a third geopolitical area,
• wherein the third geopolitical area is distinct from the first geopolitical area;
• decrypting the encrypted message using the organization-specific decryption key to obtain a plaintext message;
• and
• transmitting, to the client device, the plaintext message for display to the client device.