encryption - Decrypting customer data on the client side -

i have web app customers use allow employees exchange documents. so, employee a1 can upload document employee a2 can later access given both employees of customer a. however, employees of other customers not allowed access files uploaded a1.

i extend web app support secure documents. means have encrypt document content before storing on server. in order reduce liability not able decrypt document content. so, ideally content decrypted on client (browser) side.

i have considered solutions require decryption/encryption service deployed on customer side, don't management overhead require.

assuming customers large corporations , have typical infrastructure, e.g. ldap, how propose solve problem without deploying services in customer environment?