Financial institutions hold data that stays valuable to criminals long after a breach: identity documents, account and lending records, and transaction data. Much of it also moves through processors, outsourcers and fintech partners.
PastWipe™ reduces the usable value of stolen or exfiltrated data outside approved conditions and records each control decision as evidence. It complements existing identity, fraud, DLP, SIEM and incident-response controls.
Where banks start
- KYC and onboarding files: passport scans, proof of address, identity verification results
- Lending and credit files: applications, affordability data, collateral documentation
- Account and customer exports: CRM extracts, marketing segments, analytics datasets
- Third-party exchanges: data shared with processors, outsourcers and open-banking partners
- Board and regulatory materials: sensitive reporting, stress-test inputs, supervisory correspondence
Example workflows
- Vendor holding KYC files: KYC documents shared with an outsourced provider carry a purpose policy ("verification only") and are released only to approved systems and identities. If the provider is compromised, the bank can change the security state for that route. Later requests are denied and recorded.
- Analytics extract: a customer dataset exported for modelling is usable only inside the approved analytics environment and time window.
- Departing staff: credit files synced to a device outside policy are no longer released once identity or device conditions fail.
- Incident evidence: after an incident, evidence records show which protected records were requested and what was allowed or denied, supporting internal review and regulator reporting.
Designed to support evidence for…
- operational resilience and ICT incident obligations (for example DORA and NIS2)
- data-protection accountability (GDPR and UK GDPR)
- third-party and outsourcing risk reviews
PastWipe supplies the supporting evidence; compliance decisions remain with the institution. Regulatory evidence
Fits the existing bank stack
- Uses identity and device signals from existing systems
- Works with bank-controlled keys (see Deployment)
- Sends evidence records to existing monitoring (see Integrations)
Scope an evaluation · Request an executive briefing · Enforcement and evidence scope