A system, comprising: a service provider located in a first zone; and a remote service provider located in second zone different than the first zone; the service provider comprising one or more processors and memory including computer executable instructions such that, when executed by the one or more processors, cause the service provider to: provide an application programming interface at which a plurality of requests are received from a customer over a network; analyse the data received in each of the requests, identify the type of the data and based on the identified data type and on security requirements associated with one or more stored data policies, select an encryption algorithm from a plurality of encryption algorithms; process the data according to the selected encryption algorithm using a data key to perform the selected encryption algorithm, wherein the data key is encrypted with a customer key and is stored in the first zone, and the customer key is encrypted with a domain key and is stored in the first zone, and wherein the domain key is securely stored in a cryptographic module of the first zone; and transmit, across the network, another request comprising the processed data to the remote service provider; and the remote service provider comprising one or more processors and memory including computer executable instructions such that, when executed by the one or more processors, cause the remote service provider to: receive the other request; perform one or more operations on the received data of the other request in encrypted form in order to provide one or more services to the requesting customer, wherein the remote service lacks access to the data key. a service provider located in a first zone; and a remote service provider located in second zone different than the first zone; the service provider comprising one or more processors and memory including computer executable instructions such that, when executed by the one or more processors, cause the service provider to: provide an application programming interface at which a plurality of requests are received from a customer over a network; analyse the data received in each of the requests, identify the type of the data and based on the identified data type and on security requirements associated with one or more stored data policies, select an encryption algorithm from a plurality of encryption algorithms; process the data according to the selected encryption algorithm using a data key to perform the selected encryption algorithm, wherein the data key is encrypted with a customer key and is stored in the first zone, and the customer key is encrypted with a domain key and is stored in the first zone, and wherein the domain key is securely stored in a cryptographic module of the first zone; and transmit, across the network, another request comprising the processed data to the remote service provider; and provide an application programming interface at which a plurality of requests are received from a customer over a network; analyse the data received in each of the requests, identify the type of the data and based on the identified data type and on security requirements associated with one or more stored data policies, select an encryption algorithm from a plurality of encryption algorithms; process the data according to the selected encryption algorithm using a data key to perform the selected encryption algorithm, wherein the data key is encrypted with a customer key and is stored in the first zone, and the customer key is encrypted with a domain key and is stored in the first zone, and wherein the domain key is securely stored in a cryptographic module of the first zone; and transmit, across the network, another request comprising the processed data to the remote service provider; and the remote service provider comprising one or more processors and memory including computer executable instructions such that, when executed by the one or more processors, cause the remote service provider to: receive the other request; perform one or more operations on the received data of the other request in encrypted form in order to provide one or more services to the requesting customer, wherein the remote service lacks access to the data key. receive the other request; perform one or more operations on the received data of the other request in encrypted form in order to provide one or more services to the requesting customer, wherein the remote service lacks access to the data key.