Multilayer encryption for user privacy compliance and corporate confidentiality

A memory storage device having program instructions stored thereon that, upon execution by an Information Handling System (IHS), cause the IHS to:

• receive, from a workspace instantiated by a local management agent executed by a client device:
• (i) a request to store a once-encrypted document, and (ii) an indication that the once-encrypted document is encrypted with a controlvault key;
• transmit, to the workspace, a request to encrypt the once-encrypted document with an enterprise-issued cryptographic key to produce a twice-encrypted document;
• and
• receive, from the workspace, a copy of the twice-encrypted document, wherein the workspace encrypted the once-encrypted document with the enterprise-issued cryptographic key to produce the twice-encrypted document.

A method, comprising:

• receiving a request to access a twice-encrypted document via a web server;
• retrieving a copy of a controlvault key of a client device;
• encrypting the twice-encrypted document with a session key;
• and
• transmitting, to the web server, a copy of the controlvault key used by a workspace instantiated by a local management agent to perform a first level of encryption of the twice-encrypted document, a copy of an enterprise-issued cryptographic key used by the workspace to perform a second level of encryption of the twice-encrypted document, and a copy of the twice-encrypted document further encrypted with the session key,
• wherein the first level of encryption with the controlvault key uses a first type of cryptographic algorithm, and wherein the second level of encryption with the enterprise-issued cryptographic key uses a second type of cryptographic algorithm.