A method comprises: providing an information management system having a key management server (606, 706, 805) and a computing device; providing the computing device having an encryption service module (604, 705); providing the key management server having a secret, wherein the secret is not known to the encryption service module; at the computing device at a time T1, saving a document opened in an application program by a user; at the encryption service module, detecting a file save operation on the document; at the encryption service module, collecting user information of the user; at the encryption service module, sending the user information to the key management server; at the key management server, creating a document identifier (403, 503) for the document; at the key management server, creating a first encryption key with the document identifier, the user information and the secret; at the encryption service module, receiving the document identifier and the first encryption key from the key management server; at the encryption service module, creating a second encryption key; at the encryption service module, encrypting the document with the second encryption key to produce encrypted content; at the encryption service module, encrypting the second encryption key with the first encryption key to produce an encrypted second encryption key; at the encryption service module, storing the document identifier, the user information, the encrypted second encryption key and the encrypted content in an encrypted document; at the computing device at a time T2, opening the encrypted document in the application program by the user, wherein T2 happens after T1; at the encryption service module, detecting a file open operation on the encrypted document; at the encryption service module, retrieving the document identifier and the user information in the encrypted document; at the encryption service module, sending the document identifier and the user information to the key management server; at the key management server, creating a third encryption key with the document identifier, the user information and the secret; at the encryption service module, receiving the third encryption key from the key management server; at the encryption service module, decrypting the encrypted second encryption key in the encrypted document with the third encryption key to produce a fourth encryption key; and at the encryption service module, decrypting the encrypted content in the encrypted document with the fourth encryption key to produce unencrypted content. providing an information management system having a key management server (606, 706, 805) and a computing device; providing the computing device having an encryption service module (604, 705); providing the key management server having a secret, wherein the secret is not known to the encryption service module; at the computing device at a time T1, saving a document opened in an application program by a user; at the encryption service module, detecting a file save operation on the document; at the encryption service module, collecting user information of the user; at the encryption service module, sending the user information to the key management server; at the key management server, creating a document identifier (403, 503) for the document; at the key management server, creating a first encryption key with the document identifier, the user information and the secret; at the encryption service module, receiving the document identifier and the first encryption key from the key management server; at the encryption service module, creating a second encryption key; at the encryption service module, encrypting the document with the second encryption key to produce encrypted content; at the encryption service module, encrypting the second encryption key with the first encryption key to produce an encrypted second encryption key; at the encryption service module, storing the document identifier, the user information, the encrypted second encryption key and the encrypted content in an encrypted document; at the computing device at a time T2, opening the encrypted document in the application program by the user, wherein T2 happens after T1; at the encryption service module, detecting a file open operation on the encrypted document; at the encryption service module, retrieving the document identifier and the user information in the encrypted document; at the encryption service module, sending the document identifier and the user information to the key management server; at the key management server, creating a third encryption key with the document identifier, the user information and the secret; at the encryption service module, receiving the third encryption key from the key management server; at the encryption service module, decrypting the encrypted second encryption key in the encrypted document with the third encryption key to produce a fourth encryption key; and at the encryption service module, decrypting the encrypted content in the encrypted document with the fourth encryption key to produce unencrypted content.