Protecting documents using policies and encryption

A method comprising:

• providing a document management system managing a plurality of documents wherein the document management system comprises clients and servers;
• at a first client, executing a first interceptor code component;
• at the first client, intercepting by the first interceptor code component a request by an e-mail application, executed at the first client, to send an e-mail with a document attachment, managed by the document management system, to a second client;
• by the first interceptor code component, transferring handling of the intercepted request to a first policy enforcer program;
• using the first policy enforcer program, evaluating at least one policy associated with the document attachment;
• as a result of the evaluating, determining that the send request is allowed, but before allowing the e-mail application to send the document attachment, encrypting the document attachment;
• allowing the e-mail application to send the encrypted document attachment to the second client;
• receiving the encrypted document attachment at the second client;
• at a second interceptor code component, detecting an attempt to open the encrypted document attachment at the second client;
• by the second interceptor code component, transferring handling of the detected attempt to open request to a second policy enforcer program;
• at the second policy enforcer program, evaluating at least one policy associated with encrypted document attachment;
• as a result of the evaluating, determining that the open operation is allowed;
• at an encryption module executing on the second client, determining the encrypted document attachment is encrypted;
• at the encryption module, attempting to obtain a key for the encrypted document attachment by sending a key request to the second policy enforcer program including information comprising a process identifiers;
• at the encryption service, identifying the application program attempting to access the encrypted document at the second client;
• from the encryption service, sending identification information on the application program to a policy enforcer component, executing on the computing device;
• controlling access to the unencrypted content based on the first policy comprising:
• identifying a first application process identifier assigned by an operating system executing on the computing device for the application program, wherein the application program is attempting access to the encrypted document;
• receiving a decryption key based on the first application process identifier at the encryption service;
• using the encryption service to decrypt the encrypted document to produce the unencrypted content;
• providing the unencrypted content to the application program;
• and
• allowing the first system level operation to execute.