A method of sharing collaborative data between registered users in an online collaboration system, the collaboration system comprising a server and one or more electronic user devices that are capable of data communication with the server over a data network, each registered user being allocated a unique asymmetric key pair comprising a user public key and a user private key for encryption and decryption, the method executed on the server by one or more processors comprising: receiving encrypted data at the server over the data network from a first user via an electronic user device operated by the first user, wherein the encrypted data has been encrypted on the electronic user device and comprises: encrypted data content generated by symmetric encryption of the data content with a data key, and an associated enveloped data key comprising encrypted versions of the data key generated by asymmetric encryption of the data key with the first user's public key and a server public key respectively; decrypting the enveloped data key associated with the encrypted data content on the server using a server private key, wherein the server private key and the server public key form an asymmetric key pair; generating a new or modified enveloped data key for the encrypted data content comprising asymmetrically encrypted versions of the data key generated by the first user's public key, the server public key, and one or more additional unique public keys of one or more additional authorized users that have granted access to the data content; and storing the new or modified enveloped data key with the encrypted data content in the server to thereby enable access to the data content by the first user and the one or more additional authorized users using their respective user private keys. receiving encrypted data at the server over the data network from a first user via an electronic user device operated by the first user, wherein the encrypted data has been encrypted on the electronic user device and comprises: encrypted data content generated by symmetric encryption of the data content with a data key, and an associated enveloped data key comprising encrypted versions of the data key generated by asymmetric encryption of the data key with the first user's public key and a server public key respectively; encrypted data content generated by symmetric encryption of the data content with a data key, and an associated enveloped data key comprising encrypted versions of the data key generated by asymmetric encryption of the data key with the first user's public key and a server public key respectively; decrypting the enveloped data key associated with the encrypted data content on the server using a server private key, wherein the server private key and the server public key form an asymmetric key pair; generating a new or modified enveloped data key for the encrypted data content comprising asymmetrically encrypted versions of the data key generated by the first user's public key, the server public key, and one or more additional unique public keys of one or more additional authorized users that have granted access to the data content; and storing the new or modified enveloped data key with the encrypted data content in the server to thereby enable access to the data content by the first user and the one or more additional authorized users using their respective user private keys.