DataProtect
Encrypt It Once. It Stays Protected Everywhere.
DataProtect encrypts your sensitive files where they already live and attaches a policy that goes wherever they go. The right people open them as usual. Anyone else, whether an attacker, an AI agent or a former employee, gets nothing they can read.
- AES-256Encryption, with a unique key per file
- ~100 msAdded to file access
- 1 TB / 6 hEncrypted every 6 hours
- Your HSMYour keys, in your own hardware security module
Encrypted from the first save
Encrypted at Rest.
Checked at Every Open.
Protection is attached to the file itself. Not to the server, the network or the app around it.
- 01
Protect.
Choose a folder, and every file in it is encrypted with its own AES-256 key and a policy you define. Protection is attached to the file, not to the server, network or app around it, and it doesn't wait for a classification label.
- 02
Authorize.
Every time a person, an application or an AI agent tries to open the file, the request is checked against the policy: who they are, what device they're on, where they are. If the request doesn't match, the response isn't an error message. It's ciphertext.
- 03
Control.
Opening a file doesn't unlock it for good. The policy keeps deciding whether it can be edited, copied, printed or forwarded, wherever it travels next.
The server can be breached. The login can be stolen. The file stays encrypted.
Stolen, leaked, misplaced. Still protected.
The File Leaves.
The Protection Goes With It.
- 01 · The breach
An attacker breaches your file server.
They copy every folder. Nothing in the network stack stops a copy that looks like ordinary file access.
- Breach the file serverAllowed
- Copy every folderRecorded
- Open the stolen copiesStays encrypted
Every protected file is ciphertext.
Stolen API token
02A stolen API token reads SharePoint. The request looks authenticated, so nothing flags it.
The files it pulls are still encrypted.
AI agent workspace
03An AI agent pulls files into its workspace. It can retrieve them.
Unless the policy allows it, it can't read them.
Departing employee
04An employee leaves with a USB drive. Remove them from your identity provider.
Every copy they took stops opening.
Wrong partner
05A file is sent to the wrong partner. Revoke access, and the copy in their inbox can't be opened.
Nothing needs to be recalled.
The copy leaves. The policy doesn't let go.
Control that outlasts access
Opening a File Isn't
the Same as Owning It.
Access is a decision the policy makes again on every request, and can take back at any time.
Access by identity, role, device and location
Checked on every request, not just at sign-in.
Instant revocation
Reaches every copy, wherever it is.
Copy, print and screenshot controls
For your most sensitive files.
Secure external sharing
Partners open encrypted files directly, and you can cut them off at any time.
Approved applications only
Decide which apps can open protected files.
Offline access
For authorized users, under rules you set.
Nothing opens unseen
Encrypted Doesn't Mean Invisible. Every Access Is on Record.
Every file access is recorded: who opened it, what they did, when, and from where. Events stream to Splunk, Microsoft Sentinel, Datadog or any SIEM you already run. That gives your security team:
- File-level activity monitoring across protected files, wherever they are
- Insider-risk detection based on actual usage, not just access grants
- An audit trail for compliance reviews, insurance conversations and incident response
Zero friction for your people
Your People Won't Notice.
Attackers Will.
- On-prem file shares
- SharePoint
- OneDrive
- Box
- Egnyte
- and more
Same apps, same workflow.
Files open in Word, Excel, CAD tools and everything else, just as they did before.
No new steps.
No passwords to enter, no plugins to remember, no training required.
Any file type.
Office documents, PDFs, and large CAD and engineering files that many protection tools can't handle.
Protected in place.
On-premises file shares, SharePoint, OneDrive, Box, Egnyte and more. Nothing is migrated.
Zero-knowledge by design
Your Keys. Your HSM.
Never Bundled With the File.
- A unique key for every file. Each file key is wrapped by your own master key.
- Bring your own key. Your master key stays in your HSM (Azure or Google Cloud), and keys can only be decrypted inside it.
- Keys and files are stored separately. Decryption keys are issued per request, per identity, at the moment of access.
- Validated cryptography. FIPS 140-2 validated modules.
- Backed up and redundant. Automated key backups and multi-region failover.
Proven, not promised
Independently Verified.
No Lock-In.
SOC 2
HIPAA
Pen tested
FIPS 140-2
Straight answers
The questions
buyers actually ask.
Short answers. The details are a conversation away.
Talk to an expertWill it slow people down?
No. Protected files open in their usual applications with about 100 ms of added time.
- Explore DataFlow
Do we need DataFlow first?
No. If you know what to protect, start with DataProtect. If you don't, DataFlow shows you where your risk is.
Do we need to classify our data first?
No. Protection is set at the folder level, so it never depends on a label being right.
What happens if PostAuth is unavailable?
Authorized users keep working through offline access, and keys are backed up across regions.
- See how implementation works
How long does deployment take?
Days, with no data migration.
DataProtect · Part of the PostAuth platform
Assume Someone Gets In. Make Sure They Read Nothing.
Human or AI. Access is granted. Protection remains.