A method comprising: providing a system comprising unencrypted and encrypted document content, wherein an unencrypted document is encrypted to become an encrypted document, and the encrypted document is larger in size than the unencrypted document from which it is derived; providing a policy server, wherein the policy server stores a plurality of policies; providing an encryption service executing on the computing device (502, 504, 506, 508), wherein the encryption service operates as an add-on to the policy enforcer (503, 505, 507, 509); permitting access to an encrypted document by an application program on the computing device (502, 504, 506, 508); when an operation relating to an attempt to access an encrypted document occurs, using the encryption service to intercept the operation at an operating system level; at the encryption service, identifying the application program attempting to access the encrypted document; from the encryption service, sending identification information on the application program to the policy enforcer (503, 505, 507, 509) executing on the computing device (502, 504, 506, 508); using the policy enforcer (503, 505, 507, 509), determining if the application program can be trusted to protect unencrypted content of the encrypted document; if the application program is determined to be trusted: receiving a decryption key at the encryption service; using the encryption service to decrypt the encrypted document to produce unencrypted content, wherein using the encryption service to decrypt comprises obtaining an encryption key from the policy enforcer (503, 505, 507, 509) to decrypt the encrypted document; and providing the application program with access to the unencrypted content and allowing the intercepted operation to complete; wherein the application program is determined to be trusted at a first time T1, and after an elapsed time T2 after T1, the application program will be determined not to be trusted, and T2 is a configurable parameter; and if the application program is determined not to be trusted: providing the application program with access only to encrypted content of the encrypted document. providing a system comprising unencrypted and encrypted document content, wherein an unencrypted document is encrypted to become an encrypted document, and the encrypted document is larger in size than the unencrypted document from which it is derived; providing a policy server, wherein the policy server stores a plurality of policies; providing an encryption service executing on the computing device (502, 504, 506, 508), wherein the encryption service operates as an add-on to the policy enforcer (503, 505, 507, 509); permitting access to an encrypted document by an application program on the computing device (502, 504, 506, 508); when an operation relating to an attempt to access an encrypted document occurs, using the encryption service to intercept the operation at an operating system level; at the encryption service, identifying the application program attempting to access the encrypted document; from the encryption service, sending identification information on the application program to the policy enforcer (503, 505, 507, 509) executing on the computing device (502, 504, 506, 508); using the policy enforcer (503, 505, 507, 509), determining if the application program can be trusted to protect unencrypted content of the encrypted document; if the application program is determined to be trusted: receiving a decryption key at the encryption service; using the encryption service to decrypt the encrypted document to produce unencrypted content, wherein using the encryption service to decrypt comprises obtaining an encryption key from the policy enforcer (503, 505, 507, 509) to decrypt the encrypted document; and providing the application program with access to the unencrypted content and allowing the intercepted operation to complete; wherein the application program is determined to be trusted at a first time T1, and after an elapsed time T2 after T1, the application program will be determined not to be trusted, and T2 is a configurable parameter; and receiving a decryption key at the encryption service; using the encryption service to decrypt the encrypted document to produce unencrypted content, wherein using the encryption service to decrypt comprises obtaining an encryption key from the policy enforcer (503, 505, 507, 509) to decrypt the encrypted document; and providing the application program with access to the unencrypted content and allowing the intercepted operation to complete; wherein the application program is determined to be trusted at a first time T1, and after an elapsed time T2 after T1, the application program will be determined not to be trusted, and T2 is a configurable parameter; and if the application program is determined not to be trusted: providing the application program with access only to encrypted content of the encrypted document. providing the application program with access only to encrypted content of the encrypted document.