Not sure what you mean by cache custom objects or session cache.

For instance, I keep a separate cache per logged-in user to make sure only that user has access to the decrypted information with that key. That cache tends to be so large that we keep clearing it from memory as the user scrolls.