In various embodiments, a data storage system maintains a data store for a plurality of groups of users, where the data store includes a first section that is accessible by a first group of users, but not a second group of users, via the data storage system. In response to receiving, from a first user of the first group of users, a request to share data with the second group of users, the data storage system sends a request to a second user of the second group of users. Subsequent to receiving an acceptance from the second user, the data is stored in a second object in a second section of the data store that is accessible by the second group of users, but not the first group of users, via the data storage system.