A system for accessing data, comprising: an interface to receive a request to access data and requestor information of a requestor; and a processor to: determine whether the data comprises sensitive data configured to have an assigned access policy and an assigned storage policy; in response to a sensitive data determination that the data comprises sensitive data configured to have the assigned access policy and the assigned storage policy: retrieve a location context of the data, wherein the location context of the data comprises an access policy location to which the access policy applies; determine whether a read access policy exists for the location context; in response to determining that the read access policy exists for the location context: determine whether the requestor belongs to a security group allowed read access to the data based at least in part on the requestor information; and in response to determining that the requestor belongs to the allowed security group: determine whether a storage policy exists for the location context; in response to determining that the storage policy exists for the location context: determine a data storage location from a token; retrieve the data based on the data storage location; and provide the data. an interface to receive a request to access data and requestor information of a requestor; and a processor to: determine whether the data comprises sensitive data configured to have an assigned access policy and an assigned storage policy; in response to a sensitive data determination that the data comprises sensitive data configured to have the assigned access policy and the assigned storage policy: retrieve a location context of the data, wherein the location context of the data comprises an access policy location to which the access policy applies; determine whether a read access policy exists for the location context; in response to determining that the read access policy exists for the location context: determine whether the requestor belongs to a security group allowed read access to the data based at least in part on the requestor information; and in response to determining that the requestor belongs to the allowed security group: determine whether a storage policy exists for the location context; in response to determining that the storage policy exists for the location context: determine a data storage location from a token; retrieve the data based on the data storage location; and provide the data. determine whether the data comprises sensitive data configured to have an assigned access policy and an assigned storage policy; in response to a sensitive data determination that the data comprises sensitive data configured to have the assigned access policy and the assigned storage policy: retrieve a location context of the data, wherein the location context of the data comprises an access policy location to which the access policy applies; determine whether a read access policy exists for the location context; in response to determining that the read access policy exists for the location context: determine whether the requestor belongs to a security group allowed read access to the data based at least in part on the requestor information; and in response to determining that the requestor belongs to the allowed security group: determine whether a storage policy exists for the location context; in response to determining that the storage policy exists for the location context: determine a data storage location from a token; retrieve the data based on the data storage location; and provide the data. retrieve a location context of the data, wherein the location context of the data comprises an access policy location to which the access policy applies; determine whether a read access policy exists for the location context; in response to determining that the read access policy exists for the location context: determine whether the requestor belongs to a security group allowed read access to the data based at least in part on the requestor information; and in response to determining that the requestor belongs to the allowed security group: determine whether a storage policy exists for the location context; in response to determining that the storage policy exists for the location context: determine a data storage location from a token; retrieve the data based on the data storage location; and provide the data. determine whether a storage policy exists for the location context; in response to determining that the storage policy exists for the location context: determine a data storage location from a token; retrieve the data based on the data storage location; and provide the data. determine a data storage location from a token; retrieve the data based on the data storage location; and provide the data.