Post-breach data control
PastWipe™ addresses the stage conventional cybersecurity cannot guarantee: what happens after protected data is copied, exposed or exfiltrated.
It combines policy-aware control, cryptographic validation, identity and device context, and evidence records to reduce the usable value of stolen or exfiltrated data outside approved conditions.
PastWipe works alongside your existing identity, endpoint, network, DLP, monitoring and incident-response systems.
Scope an evaluation · Explore capabilities · Compare approaches · Contact PastWipe
Post-exfiltration focus · Policy-aware control · Evidence records · RepSec optional
Control follows the protected data
At the point of use, PastWipe asks one question: is this use still authorised under the declared conditions?
- Policy: define acceptable use. Associate protected data with rules covering authorised purpose, identity, device, environment, time or other approved conditions.
- Validation: re-check at the point of use. Evaluate whether current conditions still satisfy the policy before protected content is released, rendered or accepted.
- Evidence: record the control decision. Support review, audit and incident analysis with records showing what was requested, evaluated, allowed, denied, restricted or degraded.
Policies are configured for each data type and workflow. How PastWipe works
Prevention matters. It is not the final control point.
Firewalls, EDR, IAM, DLP, SIEM and incident response are essential. But once a usable copy leaves the protected environment, the organisation can lose practical control over how long it remains useful, where it is used and who can rely on it.
PastWipe sits after prevention, not instead of it, and reduces the consequences when prevention, detection or human behaviour fails.
| Stage | Controls | Role |
|---|---|---|
| 1. Prevent | Identity, endpoint, network, DLP and access controls | Essential |
| 2. Detect | Monitoring, telemetry, analytics, SIEM and SOC | Essential |
| 3. Respond | Containment, investigation, recovery and notification | Essential |
| 4. Control after movement | Policy validation, restricted use, degradation and evidence | PastWipe |
- Keep the existing security stack in place.
- Add control to selected high-value data and workflows.
- Re-evaluate use after copying, movement or loss of trust.
- Generate evidence for technical, legal, compliance and insurance review.
How the control cycle works
Protected data should not be treated as permanently trusted merely because access was valid when it was first obtained.
- Protect selected data. Apply PastWipe to information and workflows where post-breach misuse would cause material financial, operational, legal or public harm.
- Attach policy. Define the conditions under which the data may be opened, validated, rendered, transferred or relied upon.
- Evaluate context. Use available identity, device, environment, time, purpose and attestation signals to test whether the use remains legitimate.
- Enforce and evidence. Allow, deny, restrict or degrade the result, then create evidence suitable for operational review and investigation.
PastWipe and RepSec
Product layer and protocol layer, clearly separated.
PastWipe is the deployable post-breach control product. It works within existing environments and integrates into selected applications, data flows and enterprise controls without waiting for a new internet-wide standard.
RepSec™ is an optional protocol framework that lets different systems express policy, validation and evidence interoperably. RepSec-Q extends RepSec toward post-quantum resilience.
RepSec is optional: PastWipe deploys without it.
Built to work alongside your stack
PastWipe adds a control layer to the security tools you already run.
- Your existing controls stay in place. Access control, endpoint protection, network security, DLP, monitoring, backup and incident response keep doing their jobs.
- Control at the point of use. Policy is checked before protected content is released, rendered or accepted, and every decision is recorded.
- Scoped to your workflows. Coverage across legacy, offline and third-party workflows is agreed for each deployment.
The result is a material reduction in the value, reliability and legitimate usability of protected data after trust is lost. See enforcement scope
Priority environments
PastWipe is most relevant where copied data stays valuable long after the breach itself: regulated information, financial records, citizen data, intellectual property, operational documentation and sensitive evidence.
- Enterprise
- Insurers
- Government and public sector
- Banking and financial services
- Law firms
- Healthcare
- All sectors
Scoped evaluation
A scoped evaluation measures how PastWipe reduces exposure for a defined data class, within a defined workflow, under measurable operating conditions.
- Scope: which data genuinely needs post-breach control? Data class and sensitivity, expected users and systems, consequences of unauthorised reuse.
- Conditions: which signals are available and trustworthy? Online and offline operation, legacy and third-party dependencies, failure and recovery behaviour.
- Evidence: what result can be measured and defended? Allow, deny, restrict and degrade outcomes, false-positive and availability impact, logs and review evidence.
Frequently asked questions
Does PastWipe replace DLP, EDR, IAM or incident response? No. Those controls remain essential. PastWipe adds a separate layer aimed at maintaining control after protected data has already moved beyond the original trust boundary.
What can PastWipe control? Selected protected data used through supported, policy-aware workflows. Each request is evaluated against policy, identity, device, purpose and the current security state, then allowed, denied, restricted or degraded and recorded. A scoped evaluation measures the result for your data.
Is RepSec required? No. PastWipe can operate without RepSec.
Can PastWipe work offline? Offline operation is designed per environment, for defined periods and policies. Because it changes the trust model, local validation, cached authority, device integrity, expiry, reconciliation and failure behaviour are designed and tested for the specific environment.
Is this a replacement for encryption? No. Encryption protects confidentiality when keys and access remain controlled. PastWipe addresses whether data should still be usable when the surrounding conditions, identity, device or purpose are no longer trusted.
Evaluate post-breach control against a real workflow
Define the data, threat, operating conditions and measurable outcome. PastWipe is then evaluated as an additional control layer alongside the security systems already in place.
