1. A method for protecting sensitive data in a hosted service system, wherein the hosted service system includes a host system adapted to receive data from a tenant system, the tenant system being communicatively coupled to the host system via a communication network, and wherein the sensitive data is some of the data of the tenant system, the method comprising: receiving a database query result (DB query result) from a database, wherein the host system includes the database; determining if a part of the DB query result is associated with the sensitive data, wherein the determination is performed by a metadata service system (MSS), and wherein the MSS is adapted to maintain metadata of the sensitive data, wherein the metadata includes encryption information; if the part of the DB query result is associated with the sensitive data: receiving, from a key management system (KMS), at least one encryption key corresponding to the part of the DB query result, wherein the KMS is adapted to function as a repository of encryption keys, the encryption keys being used to encrypt the sensitive data; encrypting the part of the DB query result using the at least one encryption key corresponding to the part of the DB query result; and generating a modified DB query result, wherein the modified query result includes the encrypted part of the DB query result; generating a query result using at least one of the DB query result or the modified DB query result; transmitting the query result; generating a host response; determining if a part of the host response is associated with the sensitive data, wherein the determination is performed by the MSS; if the part of the host response is associated with the sensitive data: receiving, from the KMS, at least one encryption key corresponding to the part of the host response; decrypting the part of the host response using the at least one encryption key corresponding to the part of the host response; and generating a modified host response, wherein the modified host response includes the decrypted part of the host response; generating a client response by manipulating at least one of the host response or the modified host response, wherein the manipulation is performed using a data exchange format; and transmitting the client response.