About PastWipe

Breaches happen. Every breach, record or exposure can leave lasting consequences for institutions and the people whose data they hold. Most security investment focuses on keeping attackers out and detecting them quickly. Much less addresses what happens to data once it has already been copied.

PastWipe™ focuses on that stage. It reduces the usable value of stolen or exfiltrated data outside approved conditions, and complements existing security tools. PastWipe is the product; RepSec™ is the protocol technology it can use to exchange policy and evidence with other systems.

What we do

• Policy bound to data: conditions such as identity, device, environment, time and purpose are associated with protected data.
• Validation at the point of use: before protected data is released, current conditions are checked against policy.
• Evidence records: each allow, deny, restrict or degrade decision is recorded for security, legal, compliance and insurance review.
• Integration with existing tools: identity, endpoint, DLP, monitoring and incident-response systems remain in place.

Mission and vision

Mission: reduce the value of stolen data and prove correct use. Data theft will never be reduced to zero, and neither will mistakes, misconfigurations or vendor-side leaks. What can be reduced is the usable value of data once it leaves the conditions under which it is meant to be used, and governance can become a verifiable record instead of a static document.

Vision: useful without being vulnerable. Sensitive information should be shareable and usable with confidence because the terms of its use are enforceable and the facts of its use are verifiable, including where software agents act on an organisation's behalf.

Design principles

1. Policy that travels with the data. A thin control layer expresses policy as enforceable conditions and assumes data will cross trust zones.
2. Purpose before payload. A purpose is declared and checked before sensitive use, scoped to a data class and a time window.
3. Proof over promises. Control decisions produce signed events that can flow to SIEM/SOAR tools and board reporting.
4. Human- and agent-aware. AI agents are treated as actors with identities and limits, and their actions are recorded in the same way.

Why now

• Agentic software is real. When an agent acts, an organisation must know which data was accessed, for what purpose and under what conditions.
• Data moves faster. Data passes through services, SaaS tools, contractors and partners. Governance needs to stay effective across those hops.
• Assurance pressure is rising. Boards, insurers and regulators expect evidence of what was touched after an incident, what was not, and why.

Who we work with

Enterprise and government organisations, and the insurers, incident responders and partners who support them. Sectors

How we work

• Precise claims. We are clear about where enforcement applies. Enforcement scope
• Evidence over promises. Evaluations are scoped against defined data, workflows and success criteria.
• Not reputation management. PastWipe is a cybersecurity and privacy company. We do not provide PR, review-removal or content-removal services.

Company details

Companies House states that it does not verify the accuracy of information filed to the public register.

Official channels and impersonation

• Website: pastwipe.com · Portal: portal.pastwipe.com · Email: addresses ending in @pastwipe.com
• LinkedIn: PastWipe on LinkedIn

If a message does not come from an @pastwipe.com address, or links to another domain, treat it as unverified. PastWipe never asks for passwords, MFA codes, gift cards, crypto transfers or wallet verification. PastWipe is not a hacker group and is not affiliated with threat actors. To report impersonation, email info@pastwipe.com.

Trust Centre · Press kit · Scope an evaluation · Contact