> for example someone steals the key and then accesses the data It was why I schemed it so the key is sent to the user but not kept by you. Someone steals the

> for example someone steals the key and then accesses the data It was why I schemed it so the key is sent to the user but not kept by you. Someone steals the user key? They can ask for a restore but they won't have access to the data unless they've got the user login info too. An employee steals the encrypted data? Enjoy the time spent cracking the cryptography. A little like one of the solutions for deletion in Event Sourced systems but instead of completely losing the keys, you give it to the user first.