A method for operating a cloud gateway, comprising: generating a plurality of rules relating users and groups to data access at a plurality of cloud service providers; encrypting, at one of a plurality of pass-through devices, outgoing data that is moving through a cloud gateway en route from a proxy server to one of the plurality of cloud service providers, responsive to a data write request associated with a first user, the encrypting in accordance to one of the plurality of rules as related to the first user, wherein the plurality of pass-through devices includes a first pass-through device that is coupled to the proxy server and associated to a first cloud service provider and has a first encryption/decryption module, and a second pass-through device that is coupled to the proxy server and associated to a second cloud service provider and has a second encryption/decryption module, there being in the cloud gateway one pass-through device per cloud service provider; and decrypting, at one of the plurality of pass-through devices, incoming data that is moving through the cloud gateway en route from one of the plurality of cloud service providers to the proxy server, responsive to a data read request associated with a second user, the decrypting in accordance to one of the plurality of rules as related to the second user; and wherein, the encrypting includes encrypting an outgoing file via application of a first key in accordance with the one of the plurality of rules, encrypting the first key or a key name of the first key and file information via application of a master key, and combining the encrypted file and the encrypted first key or key name and file information as the encrypted outgoing data. generating a plurality of rules relating users and groups to data access at a plurality of cloud service providers; encrypting, at one of a plurality of pass-through devices, outgoing data that is moving through a cloud gateway en route from a proxy server to one of the plurality of cloud service providers, responsive to a data write request associated with a first user, the encrypting in accordance to one of the plurality of rules as related to the first user, wherein the plurality of pass-through devices includes a first pass-through device that is coupled to the proxy server and associated to a first cloud service provider and has a first encryption/decryption module, and a second pass-through device that is coupled to the proxy server and associated to a second cloud service provider and has a second encryption/decryption module, there being in the cloud gateway one pass-through device per cloud service provider; and decrypting, at one of the plurality of pass-through devices, incoming data that is moving through the cloud gateway en route from one of the plurality of cloud service providers to the proxy server, responsive to a data read request associated with a second user, the decrypting in accordance to one of the plurality of rules as related to the second user; and wherein, the encrypting includes encrypting an outgoing file via application of a first key in accordance with the one of the plurality of rules, encrypting the first key or a key name of the first key and file information via application of a master key, and combining the encrypted file and the encrypted first key or key name and file information as the encrypted outgoing data.