Embodiments generally provide techniques for managing data security. One embodiment includes providing, at a client system, an encrypted private key that can be decrypted using a locker key. Encrypted data is received from a remote system, and embodiment determine that the received encrypted data can be decrypted using a private key recovered by decrypting the encrypted private key. A request is transmitted to the remote system for the locker key corresponding to the encrypted private key, and the requested locker key is received from the remote system. Embodiments decrypt the encrypted private key using the received locker key to recover the private key, and decrypt the encrypted data, using the private key.