If you're offering encryption as a service, you need to consider technological and legal best practices[1]. If, at any point, you have the technological ability

If you're offering encryption as a service, you need to consider technological and legal best practices[1]. If, at any point, you have the technological ability to see a client's plaintext, that's something you need to strongly address. The most secure technological option is not always the most secure option. If you don't trust the government, then you have to choose one of 3 options: 1. Consider a system that's resilient against rubber-hose techniques (aka warrants and contempt of court). You'll probably want one where you are technologically incapable of seeing the plaintext. Perhaps offer your paying customers the option of using an open-source program or browser extension. 2. Consider a less technologically secure system where you have access to private keys so that you can fold on one client but not every one. 3. Consider never visiting that country again. I'm not sure what other choices you really have. Obviously, we can all campaign for better privacy. We can support the EFF and the ACLU, as I do. But we have to work within the laws of our countries, or they'll come down very hard on us. [1]After this incident, the only way I see Encryption as a Service as being sustainable is an open-source suite with consultation contracts.