Abstract: The present disclosure describes a system, method, and computer program for transmitting data between a backup system and an external application using an encryption proxy that is within a customer-controlled data perimeter. The encryption proxy virtually resides within a customer-controlled data perimeter and acts as an intermediary between the external application and backup system. The backup system is outside the customer-controlled data perimeter. Data is transferred between the external application and the backup system to perform backup and recovery operations. The encryption proxy encrypts and decrypts data messages between the external application and the backup application in accordance with configurable data transfer rules. The encryption proxy enables a customer to control which data items are transferred to the backup system in clear text and which data items are encrypted before being forwarded to the backup system.