A method comprising: receiving, by a computing device, first search criteria from a search initiated by a client device (205, 210, 215) against data of a cloud-based application being used by a user of the client device, wherein the first search criteria is applicable to protected and unprotected fields of the data of the cloud-based application, said data being protected or unprotected by a data security provider monitoring communications of the client device (205, 210, 215); sending, by the computing device, search criteria related to protected fields of the first search criteria to the data security provider; receiving, by the computing device, first search results based on performing a first search against the data of the data security provider using the search criteria related to protected fields of the first search criteria, wherein the first search results include tokenized or encrypted data representing data within the protected fields of the first search criteria; sending, by the computing device, the first search results and the first search criteria to the cloud-based application; receiving, by the computing device, second search results based on performing a second search against data of the cloud-based application using the first search results and the first search criteria, wherein the second search results include data of the unprotected fields of the first search criteria; federating, by the computing device, the first search results and the second search results into a third search result; and communicating, by the computing device, the third search results to the client device (205, 210, 215). receiving, by a computing device, first search criteria from a search initiated by a client device (205, 210, 215) against data of a cloud-based application being used by a user of the client device, wherein the first search criteria is applicable to protected and unprotected fields of the data of the cloud-based application, said data being protected or unprotected by a data security provider monitoring communications of the client device (205, 210, 215); sending, by the computing device, search criteria related to protected fields of the first search criteria to the data security provider; receiving, by the computing device, first search results based on performing a first search against the data of the data security provider using the search criteria related to protected fields of the first search criteria, wherein the first search results include tokenized or encrypted data representing data within the protected fields of the first search criteria; sending, by the computing device, the first search results and the first search criteria to the cloud-based application; receiving, by the computing device, second search results based on performing a second search against data of the cloud-based application using the first search results and the first search criteria, wherein the second search results include data of the unprotected fields of the first search criteria; federating, by the computing device, the first search results and the second search results into a third search result; and communicating, by the computing device, the third search results to the client device (205, 210, 215).