Data protection for organizations on computing devices

A computing device comprising:

• an application;
• and
• an organization data protection system configured to:
• expose an application programming interface (API) to protect data associated with an organization;
• expose, as part of the API, a first method that the application can invoke to pass to the organization data protection system an identifier of data to be protected and to have the organization data protection system encrypt the data to be protected with an encryption key associated with the organization, the organization data protection system determining a data status for the data prior to the first method being invoked, the data status indicating whether the data can be protected for the organization based on one or more protection statuses contained in metadata associated with the data;
• expose, as part of the API, a second method that the application can invoke to pass to the organization data protection system an identifier of the organization and to have the organization data protection system delete a decryption key that is associated with the organization and that is used to decrypt the data to be protected, the organization data protection system determining whether the metadata associated with the data includes a file descriptor identifying the decryption key that is associated with the organization;
• expose, as part of the API, a third method that the application can invoke to request that first data to be protected be encrypted with a key associated with an organization with which second data to be protected is encrypted;
• and
• expose, as part of the API, a fourth method that the application can invoke to have the organization data protection system return an indication of whether particular data has been revoked, the particular data having been revoked indicating that the particular data has been protected in the past and that a decryption key to decrypt the particular data is unavailable.