Abstract: A method of transferring data from a server via a web application by receiving a request from a user operating in a disparate security domain for data on a data store. Generating a labeled view of the data requested from the data store, wherein the label-data relationship can be trusted at a level commensurate to the trust level of the operating system. Next, determining if the data is authorized by a security policy with a policy design engine; and then transmitting the data to the user if the data is authorized. Data can also be transferred by receiving a data flow from the user for writing to the data store. Next, the data flow can be inspected for disallowed content, and a determination is made if the data flow is authorized. If the data flow is authorized, mediating the data flow between the user and the data store with a trusted monitor.