A method comprises: providing an information management system (601, 701) having a key management server (606, 706) and a computing device (602, 702); providing the key management server (606, 706) having a seed token and a secret, wherein the secret is not known to the computing device (602, 702); providing the computing device (602, 702) having an encryption service module (604, 705); at the encryption service module, sending a first encryption key request to the key management server, wherein the first encryption key request comprises a document identifier and a user identifier; at the key management server, creating a first encryption key with the document identifier, the user identifier, the seed token and the secret using a cryptographic algorithm; at the key management server, sending the first encryption key and the seed token to the encryption service module; at the encryption service module, encrypting a first document with the first encryption key to produce an encrypted document, wherein the encrypted document comprises the document identifier, the user identifier, the seed token and encrypted content; at the encryption service module after the encrypted document is created, retrieving the document identifier, the user identifier and the seed token from the encrypted document; at the encryption service module after the encrypted document is created, sending a second encryption key request to the key management server, wherein the second encryption key request comprises the document identifier, the user identifier and the seed token; at the key management server, creating a second encryption key with the document identifier, the user identifier, the seed token and the secret using a cryptographic algorithm, wherein the first encryption key and the second encryption key are identical; at the key management server, sending the second encryption key to the encryption service module; and at the encryption service module after the encrypted document is created, decrypting the encrypted document with the second encryption key to produce a second document, wherein the first document and the second document are identical. providing an information management system (601, 701) having a key management server (606, 706) and a computing device (602, 702); providing the key management server (606, 706) having a seed token and a secret, wherein the secret is not known to the computing device (602, 702); providing the computing device (602, 702) having an encryption service module (604, 705); at the encryption service module, sending a first encryption key request to the key management server, wherein the first encryption key request comprises a document identifier and a user identifier; at the key management server, creating a first encryption key with the document identifier, the user identifier, the seed token and the secret using a cryptographic algorithm; at the key management server, sending the first encryption key and the seed token to the encryption service module; at the encryption service module, encrypting a first document with the first encryption key to produce an encrypted document, wherein the encrypted document comprises the document identifier, the user identifier, the seed token and encrypted content; at the encryption service module after the encrypted document is created, retrieving the document identifier, the user identifier and the seed token from the encrypted document; at the encryption service module after the encrypted document is created, sending a second encryption key request to the key management server, wherein the second encryption key request comprises the document identifier, the user identifier and the seed token; at the key management server, creating a second encryption key with the document identifier, the user identifier, the seed token and the secret using a cryptographic algorithm, wherein the first encryption key and the second encryption key are identical; at the key management server, sending the second encryption key to the encryption service module; and at the encryption service module after the encrypted document is created, decrypting the encrypted document with the second encryption key to produce a second document, wherein the first document and the second document are identical.