A system for securely transferring data between two software programs executing on the same end-user device, the system comprising: a first program that executes on an end-user device to: send one or more encrypted data elements towards a server machine over one or more computer networks; a second program that executes on the end-user device to: intercept the one or more encrypted data elements before they leave the end-user device, with the one or more encrypted data elements remaining opaque to the second program; and, encapsulate (1A-2) the one or more encrypted data elements using an encapsulating protocol that has one or more control fields and one or more payload fields; send the encapsulated one or more encrypted data elements to the server machine in the one or more payload fields; the server machine configured with software to: receive the encapsulated one or more encrypted data elements; extract the one or more encrypted data elements from the one or more payload fields; decrypt the one or more encrypted data elements to generate one or more data elements; and, after said decryption, send the one or more data elements back to the second program in the one or more control fields of the encapsulating protocol, so that the second program can read the one or more data elements. a first program that executes on an end-user device to: send one or more encrypted data elements towards a server machine over one or more computer networks; a second program that executes on the end-user device to: intercept the one or more encrypted data elements before they leave the end-user device, with the one or more encrypted data elements remaining opaque to the second program; and, encapsulate (1A-2) the one or more encrypted data elements using an encapsulating protocol that has one or more control fields and one or more payload fields; send the encapsulated one or more encrypted data elements to the server machine in the one or more payload fields; intercept the one or more encrypted data elements before they leave the end-user device, with the one or more encrypted data elements remaining opaque to the second program; and, encapsulate (1A-2) the one or more encrypted data elements using an encapsulating protocol that has one or more control fields and one or more payload fields; send the encapsulated one or more encrypted data elements to the server machine in the one or more payload fields; the server machine configured with software to: receive the encapsulated one or more encrypted data elements; extract the one or more encrypted data elements from the one or more payload fields; decrypt the one or more encrypted data elements to generate one or more data elements; and, after said decryption, send the one or more data elements back to the second program in the one or more control fields of the encapsulating protocol, so that the second program can read the one or more data elements. receive the encapsulated one or more encrypted data elements; extract the one or more encrypted data elements from the one or more payload fields; decrypt the one or more encrypted data elements to generate one or more data elements; and, after said decryption, send the one or more data elements back to the second program in the one or more control fields of the encapsulating protocol, so that the second program can read the one or more data elements.