A method comprising: detecting, by a processor of a computing device, a network communication regarding transmission of a file for storage within an external storage provider network, wherein the file is transmitted from a first private network, and the external storage provider network is outside of the first private network; causing, by the processor, encryption of the file using an encryption key to obtain an encrypted file; causing encryption of the encryption key with a shared key to obtain an encrypted encryption key; associating, by the processor, authorization information with the encrypted file, wherein the authorization information comprises one or more restrictions on access to the encrypted file; transmitting the encrypted file for storage by the external storage provider within the external storage provider network; after transmitting, intercepting, by the processor, a request for access to the file; identifying, by the processor, requestor information regarding a requestor associated with the request, wherein the request for access is initiated within the first private network, and the external storage provider network is outside of the first private network; (416, 417) determining, by the processor, using the requestor information and a portion of the authorization information, whether the requestor is authorized to access the file; causing, by the processor, decryption of the original encryption key with the shared key to obtain the original encryption key; causing, by the processor, decryption of the original file using the original encryption key; and providing, to the requestor, by the processor, access to the file. detecting, by a processor of a computing device, a network communication regarding transmission of a file for storage within an external storage provider network, wherein the file is transmitted from a first private network, and the external storage provider network is outside of the first private network; causing, by the processor, encryption of the file using an encryption key to obtain an encrypted file; causing encryption of the encryption key with a shared key to obtain an encrypted encryption key; associating, by the processor, authorization information with the encrypted file, wherein the authorization information comprises one or more restrictions on access to the encrypted file; transmitting the encrypted file for storage by the external storage provider within the external storage provider network; after transmitting, intercepting, by the processor, a request for access to the file; identifying, by the processor, requestor information regarding a requestor associated with the request, wherein the request for access is initiated within the first private network, and the external storage provider network is outside of the first private network; (416, 417) determining, by the processor, using the requestor information and a portion of the authorization information, whether the requestor is authorized to access the file; causing, by the processor, decryption of the original encryption key with the shared key to obtain the original encryption key; causing, by the processor, decryption of the original file using the original encryption key; and providing, to the requestor, by the processor, access to the file.