Abstract: A method for key retrieval. The method comprises receiving, from a device, a request to access a key associated with an encrypted data object; identifying at least one policy associated with the key, the policy including requirements for a geographic origin of the request; receiving a signed location of the device, the location being signed using a private key associated with the device; and verifying the signed location using a public key associated with the device. The method further comprises determining if the verified location satisfies the requirements for a geographic origin; and if the location satisfies the requirements for a geographic origin, providing the key to the device.

Abstract: A method of managing access to a key. The method comprises associating the key with an encrypted data object, the key being required to decrypt the data object; generating a number of fragments of the key, the number of fragments corresponding to a number of parties subject to a fragmentation agreement; and encrypting each fragment with a public key corresponding to each of the parties. The method further comprises encrypting each encrypted fragment with a public key of a trusted party; and storing the encrypted fragments with the encrypted data object on a server of the trusted party.