System and Method to enable Shared SaaS Multi-Tenancy using Customer Data Storage, Customer-controlled Data Encryption Keys

A computer based system for controlling access to customer data of a multi-tenant software as a service (SaaS) system comprising a SaaS system cloud, a SaaS encrypted data store, and an agent facing application interface (API), the computer based system comprising:

• a customer-controlled cloud in communication with the SaaS system cloud, wherein the customer-controlled cloud comprises a key management system (KMS);
• and
• a SaaS agent disposed at a user endpoint in communication with the SaaS system cloud, the SaaS agent configured to:
• transmit metadata and telemetry information related to the customer data to the agent facing API;
• receive storage credentials from the KMS via the agent facing API;
• and
• store the customer data in the SaaS encrypted data store using the received storage credentials.

A computer based method for controlling access to customer data of a multi-tenant software as a service (SaaS) system comprising a metadata store, a SaaS encrypted data store, and a SaaS agent facing application interface (API), wherein the access is controlled via a SaaS agent disposed at a user endpoint in communication with the SaaS system cloud and a customer cloud comprising a key management system (KMS), wherein the customer cloud is in communication with the SaaS system cloud, the method comprising:

• the SaaS agent transmitting metadata and telemetry information related to the customer data to the SaaS agent facing API;
• receiving storage credentials from the KMS via the agent facing API;
• and
• storing the customer data in the SaaS encrypted data store using the received storage credentials.