A method comprising: providing a document management system managing a plurality of documents wherein the document management system comprises clients and servers; at a first client, executing a first policy enforcer program; at the first client, trapping by the first policy enforcer program a request by an e-mail application to send an e-mail with a document attachment, managed by the document management system, to a second client; at the first policy enforcer program, evaluating at least one policy associated with document attachment; as a result of the evaluating, determining that the send request is allowed, but before allowing the e-mail application to send the document attachment, encrypting the document attachment; allowing the e-mail application to send the encrypted document attachment to the second client; receiving the encrypted document attachment at the second client; detecting an attempt to open the encrypted document attachment at the second client at a second policy enforcer program at the second client; at the second policy enforcer program, evaluating at least one policy associated with encrypted document attachment; as a result of the evaluating, determining that the open operation is allowed; further comprising at an encryption module executing on the second client, determining the encrypted document attachment is encrypted; in response to a read operation on the encrypted document attachment once the open operation is completed, at the second policy enforcer program, sending a request to a key server of the document management system comprising: at the encryption module, attempting to obtain a key for the encrypted document attachment by sending a key request to the second policy enforcer program including information comprising a process identifier; at the second policy enforcer program, receiving the key request from the encryption module and evaluating the request based on the information comprising a process identifier; and when the process identifier matches a previously saved process identifier, at the second policy enforcer program, sending the request to the key server of the document management system; after receiving the key from the key server at the second client, passing the key to the encryption module; and at the encryption module, using the received key to unencrypt the encrypted document attachment and obtain the unencrypted document attachment. providing a document management system managing a plurality of documents wherein the document management system comprises clients and servers; at a first client, executing a first policy enforcer program; at the first client, trapping by the first policy enforcer program a request by an e-mail application to send an e-mail with a document attachment, managed by the document management system, to a second client; at the first policy enforcer program, evaluating at least one policy associated with document attachment; as a result of the evaluating, determining that the send request is allowed, but before allowing the e-mail application to send the document attachment, encrypting the document attachment; allowing the e-mail application to send the encrypted document attachment to the second client; receiving the encrypted document attachment at the second client; detecting an attempt to open the encrypted document attachment at the second client at a second policy enforcer program at the second client; at the second policy enforcer program, evaluating at least one policy associated with encrypted document attachment; as a result of the evaluating, determining that the open operation is allowed; further comprising at an encryption module executing on the second client, determining the encrypted document attachment is encrypted; in response to a read operation on the encrypted document attachment once the open operation is completed, at the second policy enforcer program, sending a request to a key server of the document management system comprising: at the encryption module, attempting to obtain a key for the encrypted document attachment by sending a key request to the second policy enforcer program including information comprising a process identifier; at the second policy enforcer program, receiving the key request from the encryption module and evaluating the request based on the information comprising a process identifier; and when the process identifier matches a previously saved process identifier, at the second policy enforcer program, sending the request to the key server of the document management system; at the encryption module, attempting to obtain a key for the encrypted document attachment by sending a key request to the second policy enforcer program including information comprising a process identifier; at the second policy enforcer program, receiving the key request from the encryption module and evaluating the request based on the information comprising a process identifier; and when the process identifier matches a previously saved process identifier, at the second policy enforcer program, sending the request to the key server of the document management system; after receiving the key from the key server at the second client, passing the key to the encryption module; and at the encryption module, using the received key to unencrypt the encrypted document attachment and obtain the unencrypted document attachment.