Post-breach data control
PastWipe™ addresses the stage conventional cybersecurity cannot guarantee: what happens after protected data is copied, exposed or exfiltrated.
It combines policy-aware control, cryptographic validation, identity and device context, and evidence records to reduce the usable value of stolen or exfiltrated data outside approved conditions.
PastWipe complements existing identity, endpoint, network, DLP, monitoring and incident-response systems. It does not replace them.
Scope an evaluation · Explore capabilities · Compare approaches · Contact PastWipe
Post-exfiltration focus · Policy-aware control · Evidence records · RepSec optional
Control follows the protected data
At the point of use, PastWipe asks one question: is this use still authorised under the declared conditions?
- Policy: define acceptable use. Associate protected data with rules covering authorised purpose, identity, device, environment, time or other approved conditions.
- Validation: re-check at the point of use. Evaluate whether current conditions still satisfy the policy before protected content is released, rendered or accepted.
- Evidence: record the control decision. Support review, audit and incident analysis with records showing what was requested, evaluated, permitted, denied or degraded.
The decision model is configured for each deployment, data type, workflow and level of integration. How PastWipe works
Prevention matters. It is not the final control point.
Firewalls, EDR, IAM, DLP, SIEM and incident response are essential. But once a usable copy leaves the protected environment, the organisation can lose practical control over how long it remains useful, where it is used and who can rely on it.
PastWipe sits after prevention, not instead of it, and reduces the consequences when prevention, detection or human behaviour fails.
| Stage | Controls | Role |
|---|---|---|
| 1. Prevent | Identity, endpoint, network, DLP and access controls | Essential |
| 2. Detect | Monitoring, telemetry, analytics, SIEM and SOC | Essential |
| 3. Respond | Containment, investigation, recovery and notification | Essential |
| 4. Control after movement | Policy validation, restricted use, degradation and evidence | PastWipe |
- Keep the existing security stack in place.
- Add control to selected high-value data and workflows.
- Re-evaluate use after copying, movement or loss of trust.
- Generate evidence for technical, legal, compliance and insurance review.
How the control cycle works
Protected data should not be treated as permanently trusted merely because access was valid when it was first obtained.
- Protect selected data. Apply PastWipe to information and workflows where post-breach misuse would cause material financial, operational, legal or public harm.
- Attach policy. Define the conditions under which the data may be opened, validated, rendered, transferred or relied upon.
- Evaluate context. Use available identity, device, environment, time, purpose and attestation signals to test whether the use remains legitimate.
- Enforce and evidence. Permit, deny, restrict or degrade the result, then create evidence suitable for operational review and investigation.
PastWipe and RepSec
Product layer and protocol layer, clearly separated.
PastWipe is the deployable post-breach control product. It works within existing environments and integrates into selected applications, data flows and enterprise controls without waiting for a new internet-wide standard.
RepSec™ is an optional protocol framework that lets different systems express policy, validation and evidence interoperably. RepSec-Q extends RepSec toward post-quantum resilience.
- RepSec is optional. It is not required to deploy PastWipe.
- RepSec is not presented as a universally adopted standard.
- Post-quantum properties depend on the selected cryptography and implementation.
Where PastWipe enforces
PastWipe enforces policy in supported, policy-aware workflows, and is precise about where that enforcement applies.
- It works alongside prevention. PastWipe complements access control, endpoint protection, network security, DLP, monitoring, backup and incident response. It does not replace them.
- Control is strongest before and during authorised use. Content an authorised viewer photographs, screenshots or retypes, and data exported into an unsupported, unrestricted format, are outside enforcement.
- Coverage is defined per deployment. Enforcement across legacy, offline and third-party workflows depends on integration depth, supported applications, connectivity, device trust and identity signals, and is agreed in each evaluation.
The result is a material reduction in the value, reliability and legitimate usability of protected data after trust is lost.
Priority environments
PastWipe is most relevant where copied data stays valuable long after the breach itself: regulated information, financial records, citizen data, intellectual property, operational documentation and sensitive evidence.
- Enterprise and corporate
- Insurers
- Government and public sector
- Banking and financial services
- Law firms
- Healthcare
- Legal and intellectual property
- All sectors
Technical evaluation
The right question is not "Does it stop every breach?" The useful question is whether PastWipe can reduce exposure for a defined data class, within a defined workflow, under measurable operating conditions.
- Scope: which data genuinely needs post-breach control? Data class and sensitivity, expected users and systems, consequences of unauthorised reuse.
- Conditions: which signals are available and trustworthy? Online and offline operation, legacy and third-party dependencies, failure and recovery behaviour.
- Evidence: what result can be measured and defended? Allow, deny and degradation outcomes, false-positive and availability impact, logs and review evidence.
Frequently asked questions
Does PastWipe replace DLP, EDR, IAM or incident response? No. Those controls remain essential. PastWipe adds a separate layer aimed at maintaining control after protected data has already moved beyond the original trust boundary.
Does PastWipe stop every stolen file being used? PastWipe controls use within supported, policy-aware workflows. The outcome depends on the protected format, integration, workflow, policy, available context signals and whether an unrestricted plaintext copy already exists. Each evaluation measures the reduction in utility and legitimate acceptance under unsupported conditions for your data.
Is RepSec required? No. PastWipe can operate without RepSec.
Can PastWipe work offline? Offline operation is designed per environment, for defined periods and policies. Because it changes the trust model, local validation, cached authority, device integrity, expiry, reconciliation and failure behaviour are designed and tested for the specific environment.
Is this a replacement for encryption? No. Encryption protects confidentiality when keys and access remain controlled. PastWipe addresses whether data should still be usable when the surrounding conditions, identity, device or purpose are no longer trusted.
Evaluate post-breach control against a real workflow
Define the data, threat, operating conditions and measurable outcome. PastWipe can then be assessed as an additional control layer, without replacing the security systems already in place.
Scope a controlled evaluation · Request an executive briefing
