The PostAuth Platform
PostAuth watches how your files move, understands what's in them and who puts them at risk, and encrypts them so they stay protected wherever they end up: on a breached server, in an AI agent's workspace, or in a former employee's inbox.
The problem
An attacker with a valid password or API token is just another authenticated user. Nothing flags them.
When an attacker reaches a file server, SharePoint or a backup, the data never "leaves" in a way a DLP tool can see.
They're supposed to open files. The risk is what happens to those files next.
Post-Authentication Data Security closes that gap by protecting the file itself. Access can be granted, stolen or misused, and the data stays protected.
PostAuth at a glance
Three capabilities, one platform. Use all three, or start directly with Protect if you already know what needs protecting.
A lightweight endpoint sensor tracks how files are created, copied, moved and deleted, and by whom. A browser extension links uploads and downloads to those same files, including uploads to AI tools like ChatGPT, Claude and Gemini, and to personal email and cloud accounts.
Built-in AI classification identifies what each file contains, from customer data and financials to source code and IP. Activity is correlated over time into a living risk profile that ranks your riskiest users, devices, folders and systems.
Protect a folder, and every file in it gets its own AES-256 encryption and a policy that goes wherever it goes. Every attempt to open the file is checked against that policy. If the requester isn't authorized, whether that's an attacker, an unapproved app or an AI agent, they get ciphertext instead of an error. Revoke access once, and every copy goes dark.
Why PostAuth is different
Once a file is encrypted, it doesn't need to be watched. There are no exits to guard.
AI tells you where to start. A wrong label changes priorities, never protection.
No alert queues, no rule updates as your environment changes.
Bring your own master key, stored in your own HSM. PostAuth can't read your data.
DLP loses sight of a file once it's out. Because every open of a protected file is checked, every open is logged: who, what, when, from where and what action, wherever the file is. Events stream to Splunk, Microsoft Sentinel, Datadog or any SIEM, for file-level monitoring, insider-risk detection based on actual usage, and an audit trail for compliance, insurance and incident response.
| Who | When | From where | Action | Result |
|---|---|---|---|---|
| Analyst | 09:14 | Managed laptop | Open | Allowed |
| Analyst | 09:31 | Managed laptop | Upload | Allowed |
| svc-backup | 02:07 | Unknown host | Open | Denied by policy |
| AI agent | 11:48 | Unapproved app | Read | Denied by policy |
Implementation
Push lightweight agents to endpoints and file servers through the deployment tools you already use, and connect your identity provider. Nothing changes for your people.
DataFlow learns how files move, what's inside them, and which users, devices and folders carry the most risk. You get a clear, ranked view of where to protect first.
Already know what to protect? Skip straight to step 3.
Choose the folders and shares to protect, and who can open them, by role, device and location. Policies use the groups you already manage in your identity provider, and no labeling project is required.
Files are encrypted where they already live, in the background, with no migration and no interruption to work. From then on, new files in protected folders are protected automatically, and protection stays with every file wherever it goes.
Once your data is protected, it stays protected. There's nothing left to tune.
See it on your own filesEnterprise-ready integrations
PostAuth adds a protection layer on top of your existing tools. Nothing is replaced and nothing is migrated.