I am making a Teams Tab application. The users can create and store some data, and we as the app creators should not have access to this data: this is a hard requirement due to personal data protection laws.

Right now the data is stored in the LocalStorage on the user’s device. This solution is good enough from the legal perspective (data does not leave the user’s device at all), but this does not allow the user to sync it between multiple devices.

Is there a way to somehow securely encrypt the data on the client? The assumption is that the client does not have to trust our company, but they trust Microsoft and have a Microsoft tenant. Something like:

• An SDK method in Teams that securely encrypts the data using the current user’s info. This way the data can be stored on our servers, because MS guarantees that it cannot be decrypted anywhere except for the user’s own device (something like DPAPI on Windows)
• Store the data in some storage provided by the client’s own MS tenant

Are there any ways to achieve this?