Systems and methods of multi-key encryption for multi-tenant database

1. A method for data isolation in multi-tenant environments, comprising:

receiving, by a vault API, an encryption request comprising a client ID associated with a client, an entity name, an entity ID and entity data;

generating, by the vault API, a key ID corresponding to the client ID;

issuing, by the vault API and to a cloud-based computer system, an encryption request comprising the generated key ID and the entity data;

generating, by the cloud-based computer system, a data key based on the key ID, wherein the data key is associated with the entity data;

encrypting, by the cloud-based computer system, the entity data by using the data key;

transmitting, by the cloud-based computer system and to the vault API, the encrypted data; and

storing, by the vault API, the encrypted data and key ID in a client collection within a vault database, wherein the client collection is associated with the client ID.

2. The method of claim 1 , wherein the entity data includes a property ID, a loan number, and a reserve price.

3. The method of claim 1 , wherein the encrypted data includes an identifier having an identifier value and the client collection includes a plurality of encrypted data sets, each of the plurality of encrypted data sets includes a respective identifier having a corresponding identifier value.

4. The method of claim 3 , wherein the vault database further comprises a plurality of client collections associated with a plurality of clients, the method further comprising:

receiving, by the vault API, a search request comprising a query, the query including an identifier;

obtaining, by the vault API, an additional plurality of encrypted data sets from the plurality of client collections corresponding to the query according to a match of the query identifier with the identifier value of each of the plurality of encrypted data sets;

providing, by the vault API to the cloud-based computer system, the encrypted data sets and key IDs corresponding to the encrypted data sets;

decrypting, by the cloud-based computer system, the obtained additional plurality of encrypted data sets using a respective data key of each of the additional obtained plurality of encrypted data sets based on the key IDs; and

presenting, by a client-side module, the decrypted plurality of data sets.

5. The method of claim 4 , wherein the search request further includes a universal ID number.

6. The method of claim 1 , further comprising:

receiving, by the vault API, an update to the entity data;

providing, by the vault API and to the cloud-based computer system, the encrypted entity data, the key ID, and the update;

decrypting, by the cloud-based computer system, the encrypted entity data using the data key corresponding to the key ID;

updating, by the cloud-based computer system, the entity data according to the received update;

encrypting, by the cloud-based computer system, the updated entity data;

returning, by the cloud-based computer system to the vault API, the encrypted updated entity data and an updated key ID corresponding to an updated data key associated with the updated entity data; and

storing, by the vault API, the encrypted updated entity data and updated key ID in the client collection.

7. The method of claim 1 , wherein the could-based computer system further comprises an encryption module, a key manager module, and a custom key store module.

8. The method of claim 1 , wherein the entity data comprises data regarding a property.

9. A system for data isolation in multi-tenant database computing device environments, comprising:

an online data vault system comprising a processor, a memory and a data communication interface, the online data vault system storing a plurality of client collections corresponding to a plurality of clients, wherein each of the client collections including a plurality of encrypted entity data sets, the online data vault system programmed to:

receive a search request comprising a query that includes an identifier;

retrieve a subset of the plurality of encrypted data sets from the plurality of client collections, the subset including encrypted data sets corresponding to the query that match the identifier;

provide the subset of the plurality of encrypted data sets and a plurality of key IDs corresponding to the encrypted data sets to a cloud-based computer system; wherein

the cloud-based computer system comprising a second processor, a second memory, and a second data communication interface, programmed to:

receive from the online data vault system, the subset of the encrypted data sets and the corresponding key IDs;

decrypt the received subset of encrypted data sets using respective data key of each of the received encrypted data sets based on the plurality of key IDs;

provide the decrypted subset of the data sets to the online data vault system; wherein the online data vault system programmed to:

receive the decrypted subset of the data sets from the cloud-based computer system; and

cause a client-side module to present the decrypted subset of data sets to a user.