Since you run the matrix server in that environment you can add a hook for a master corporate account to be auto included in every room made. It would then be privy to any encryption keys.