A method of providing a searchable encrypted database and for searching that database, performed by a vault creator apparatus, a first party and a third party, and comprising: obtaining, by the vault creator apparatus, plain text data from a device associated with the first party, and obtaining first and second encryption keys; parsing, by the vault creator apparatus, the plain text data using a priori knowledge of the plain text data structure to identify a plurality of data blocks and associated metadata components; encrypting, by the vault creator apparatus, the plurality of data blocks using said first encryption key to provide one or more encrypted data blocks; separately encrypting, by the vault creator apparatus, the metadata components with said second encryption key to provide a plurality of encrypted metadata components; providing, by the vault creator apparatus the second encryption key to the third party for enabling searching of the searchable encrypted database; storing, by the vault creator apparatus, the encrypted data block(s) and encrypted metadata components in a storage vault to provide a searchable encrypted database whilst discarding the plain text data and said first encryption key; defining, by the third party, a search term; encrypting, by the third party, the search term with said second encryption key to provide an encrypted search term; searching, by the vault creator apparatus, said searchable encrypted database using said encrypted search term to determine whether or not the encrypted search term matches one or more of the encrypted metadata components; returning, by the vault creator apparatus, a search result; in the event that the returned search result indicates that the encrypted search term matches one or more of the encrypted metadata components; requesting, by the third party, a consent of the first party to recover the first encryption key and, in the event that consent is provided, recovering, by the vault creator apparatus, said first encryption key; recovering, by the vault creator apparatus, said encrypted data block(s) associated with the matching encrypted metadata component(s); and using, by the vault creator apparatus, the first encryption key to decrypt the recovered encrypted data blocks and providing the decrypted data blocks associated with the search term to the third party. obtaining, by the vault creator apparatus, plain text data from a device associated with the first party, and obtaining first and second encryption keys; parsing, by the vault creator apparatus, the plain text data using a priori knowledge of the plain text data structure to identify a plurality of data blocks and associated metadata components; encrypting, by the vault creator apparatus, the plurality of data blocks using said first encryption key to provide one or more encrypted data blocks; separately encrypting, by the vault creator apparatus, the metadata components with said second encryption key to provide a plurality of encrypted metadata components; providing, by the vault creator apparatus the second encryption key to the third party for enabling searching of the searchable encrypted database; storing, by the vault creator apparatus, the encrypted data block(s) and encrypted metadata components in a storage vault to provide a searchable encrypted database whilst discarding the plain text data and said first encryption key; defining, by the third party, a search term; encrypting, by the third party, the search term with said second encryption key to provide an encrypted search term; searching, by the vault creator apparatus, said searchable encrypted database using said encrypted search term to determine whether or not the encrypted search term matches one or more of the encrypted metadata components; returning, by the vault creator apparatus, a search result; in the event that the returned search result indicates that the encrypted search term matches one or more of the encrypted metadata components; requesting, by the third party, a consent of the first party to recover the first encryption key and, in the event that consent is provided, recovering, by the vault creator apparatus, said first encryption key; recovering, by the vault creator apparatus, said encrypted data block(s) associated with the matching encrypted metadata component(s); and using, by the vault creator apparatus, the first encryption key to decrypt the recovered encrypted data blocks and providing the decrypted data blocks associated with the search term to the third party.