Secrets do not stay where you put them.
The intended arrangement is clean. Keys live on hardware, recovery material lives on paper in a safe, counterparty records live in a system with access control. The actual arrangement, on the machines we get called into, is less tidy.
A keystore export somebody made during a migration and never deleted. A photograph of a recovery sheet in a synced camera folder because it was faster than writing it out twice. A due diligence pack full of counterparty identity documents in a downloads directory. A spreadsheet of investor details that started as a draft and became the record. None of that is negligence exactly. It is what happens when work is urgent.
Map first, then decide.
The agent inventories sensitive and regulated material across Windows, macOS, and Linux, scores every machine for exposure, and produces a per machine breakdown rather than an organization wide number that tells you nothing actionable. Vulnerability scanning runs alongside it with trend reporting, so you can see whether the picture is improving.
The output is a map. Which machines hold material that would hurt if it left, how much, and where it sits. That is the input to every decision after it, including which endpoints deserve the strict execution control policy and which ones need to be cleaned up and left alone.
Encryption that travels with the file.
Enforcement layers on encryption and decryption applied as files are used, several compliance profiles, and an allowlist of the applications and channels permitted to open protected material. In practice a protected file stays encrypted when it moves outside the approved application or the approved channel, so a copy dragged into a personal sync folder or attached to a message is not readable at the other end.
Compliance profiles matter for funds and desks with reporting obligations, because a counterparty questionnaire asking how you protect client identity documents has a better answer than an assurance.
Sensitive Data Discovery
Find the material, quantify the exposure, and get a per device breakdown you can act on.
- Identity and payment card material located across Windows, macOS, and Linux.
- A breach risk baseline you can measure future months against.
- Vulnerability scans reported as a trend over time.
- A per machine breakdown of the material left unprotected, rather than one aggregate figure.
| Platforms | Windows, macOS, and Linux |
|---|---|
| Detects | Identity and payment card material, plus patterns you define |
| Output | A risk baseline, plus a per machine breakdown of the exposure |
| Scanning | Vulnerability scans reported as a trend over time |
| Use | The map that scopes every other control decision |
| Priced by | Device, monthly |
monthly rate, taken up front QTY
Encryption and Channel Control
Everything in the discovery line, plus the controls that act on what it found.
- Encryption and decryption applied to protected files on the fly.
- Multiple compliance profiles for organizations with reporting obligations.
- An allowlist of the applications and channels that may open secured material.
- Protected content remains encrypted outside the approved application or channel.
| Includes | The full discovery capability of the classification line |
|---|---|
| Encryption | Applied and reversed on the fly for protected files |
| Channels | An allowlist of applications and channels for secured material |
| Profiles | Multiple compliance profiles supported |
| Effect | A copy taken outside the approved path is not readable |
| Priced by | Device, monthly |
monthly rate, taken up front QTY
Where this layer stops, stated precisely
This is the line where vendors tend to overclaim, so here is the exact shape of it.
- The detectors that ship with this product are engineered for identity and payment card material. Custom patterns can be pointed at the directories and file types where key material tends to accumulate, and that is worth doing, but treat it as a hygiene sweep rather than a guarantee that a secret has been found.
- We report file locations, types, and risk scores. We do not read, extract, or transmit the value of a private key or a recovery phrase, and no part of this service is designed to.
- Discovery describes the present. It is not evidence that nothing left before the agent was installed.
- Encryption governs files and channels. It does not govern an authorized user reading a decrypted file on their own screen and typing what they see somewhere else.