A system including a managing device communicatively coupled to a keyholding device. The managing device includes a data manager executing on the processor configured to receive a request to decrypt encrypted data from a protected application and obtain the keyholding device identifier from a trusted device list. The data manager is further configured to send a connection request to the keyholding device using the keyholding device identifier and create an established connection in response to determining that the keyholding device has accepted the connection request. The data manager is further configured to request, via the established connection, the encryption key from a keyholding process executing on the keyholding device and obtain the encryption key from the keyholding process on keyholding device. The data manager is further configured to decrypt the encrypted data using encryption key to obtain decrypted data and send the decrypted data to the protected application.