A server for sealing and unsealing user data, said server comprising: a processor; and a memory device, which stores: an encryption key, user data encrypted by the encryption key, a plurality of authenticated manifests each comprising authenticated measurements of the server by third parties (A, B), and a server application comprising a manifest checker component and a sandbox component, the encryption key being sealed in the first memory device using a measurement of the manifest checker component; the processor being adapted by the server application to: implement the manifest checker component to obtain current measurements of the server corresponding to the authenticated measurements of the server, and to compare the current measurements to the authenticated measurements, wherein the measurements of the server do not include any measurement of the manifest checker component; implement the sandbox component to unseal the encryption key using a current measurement of the manifest checker component, and to access the user data using the encryption key, if the current measurements of the server sufficiently match the authenticated measurements of the server, or prevent implementation of the sandbox component, if the current measurements of the server do not sufficiently match the authenticated measurements of the server, wherein each of the plurality of authenticated manifests has been authenticated by a different certificate. a processor; and a memory device, which stores: an encryption key, user data encrypted by the encryption key, a plurality of authenticated manifests each comprising authenticated measurements of the server by third parties (A, B), and a server application comprising a manifest checker component and a sandbox component, the encryption key being sealed in the first memory device using a measurement of the manifest checker component; the processor being adapted by the server application to: implement the manifest checker component to obtain current measurements of the server corresponding to the authenticated measurements of the server, and to compare the current measurements to the authenticated measurements, wherein the measurements of the server do not include any measurement of the manifest checker component; implement the sandbox component to unseal the encryption key using a current measurement of the manifest checker component, and to access the user data using the encryption key, if the current measurements of the server sufficiently match the authenticated measurements of the server, or prevent implementation of the sandbox component, if the current measurements of the server do not sufficiently match the authenticated measurements of the server, wherein each of the plurality of authenticated manifests has been authenticated by a different certificate. implement the manifest checker component to obtain current measurements of the server corresponding to the authenticated measurements of the server, and to compare the current measurements to the authenticated measurements, wherein the measurements of the server do not include any measurement of the manifest checker component; implement the sandbox component to unseal the encryption key using a current measurement of the manifest checker component, and to access the user data using the encryption key, if the current measurements of the server sufficiently match the authenticated measurements of the server, or prevent implementation of the sandbox component, if the current measurements of the server do not sufficiently match the authenticated measurements of the server, wherein each of the plurality of authenticated manifests has been authenticated by a different certificate. <EOS>