Most data-security categories are built to stop data from leaving, or to find where it is. PastWipe™ starts from the assumption that some copies will leave anyway, and asks a different question: should this copy still be usable here, now, for this purpose? It complements the tools below rather than replacing them.
Category comparison
| Approach | Main question it answers | Where it stops | What PastWipe adds |
|---|---|---|---|
| Data loss prevention (DLP) | Is sensitive data leaving through an approved channel? | Once a copy has left, DLP has no further say over it | Re-checks conditions when the copy is used, in supported workflows |
| DRM / IRM | Is this user licensed to open this document? | Usually tied to a user licence, not to device, environment or incident state | Evaluates identity together with device, environment, purpose and current security state, and records every decision |
| Encryption (at rest, in transit) | Can someone without the key read the data? | Anyone with valid access or a stolen session sees plaintext | Asks whether valid access should still work when conditions are no longer trusted |
| CASB / SSE | Which cloud apps are used, and is traffic allowed? | Controls the route, not the data after it arrives | Keeps policy attached to selected data beyond the gateway |
| DSPM | Where is sensitive data, and who can reach it? | Finds and scores exposure; does not control later use | Acts on selected data at the point of use and produces evidence |
These are categories, not products. Many organisations run several of them, and PastWipe sits alongside them. Integrations and deployment
Architecture overview
Example: degrading a request after an incident
A worked example.
- A finance export containing customer records is protected with a policy: purpose "quarterly reporting", approved devices only, normal security state.
- An incident is declared for one workload. A copy of the export is later opened on an unmanaged laptop outside the approved environment.
- PastWipe evaluates the request. Identity is valid, but the device is not approved and the security state has changed.
- The policy says to degrade: the requester sees totals only, not individual records.
- The decision is recorded as evidence:
{
"record": "ev-2026-09-29-000184",
"time": "2026-09-29T09:14:07Z",
"object": "exports/customers-q3.xlsx#sheet=records",
"operation": "render",
"requester": { "identity": "j.doe@example.com", "device": "unmanaged", "environment": "outside-approved" },
"policy": "finance-export-v4",
"declared_purpose": "quarterly-reporting",
"security_state": "incident-declared:workload-17",
"decision": "degrade",
"result": "aggregate-only",
"signature": "ed25519:…"
}
The record shows what was requested, what was evaluated and what happened. Evidence scope