A system for sharing data between tenants served by a software instance. In the system, a first tenant can ensure that data is transferred to a trusted connection by virtue of a trusted established between the first tenant and a second tenant, and a trusted connection between the second tenant and a third tenant. The system allows the identity of the third tenant to be kept secret from the first tenant, thus maintaining the privacy of the third tenants. In addition, the system allows for the first tenant to force control over the tenants with which the second tenant is allowed to share the first portion of the data, and the second tenant can provide an additional layer of this control.