This paper describes a security problem involving an online data repository which acts as a proxy for multiple companies allowing their customers to perform online services (e.g., pay invoices). The repository's host is trusted to honestly fulfil its duties in maintaining the data in a manner consistent with each companies' required services. However, the information stored by the repository remains private in that the repository's host cannot openly read any companies' operational data, nor does it learn the identities of any companies' customers. We contrast several approaches describing their viability for web deployment using existing technologies. This is a fundamentally new security problem with no established literature or clearly defined cryptographic solution. The project originated from a commercial attempt to design a secure online data archive that allows a customer to pay and view invoices online. © 2010 IEEE.