THE LIFE OF ONE FILE

01 — CREATED

A file is born unprotected.

An engineer saves a drawing to the share. From this second on, its safety depends entirely on everyone who can log in.

Schedule a demo How PADS works

01 CREATED

02 PROTECTED

03 IN MOTION

04 BREACHED

05 NEUTRALIZED

01 / POST-ACCESS DATA SECURITY

The login opens the door.
PADS protects what’s inside.

Identity controls who gets in. PostAuth keeps control attached to the data they access — across applications, storage, and organizational boundaries.

POSTAUTH / PROTECTED OBJECT

FP / SECURE OBJECT↗

The file.
Still yours.

A F E C 0 2 9 7 1 8 A F E C 0 2 9 7 1 8 A F

8 A F E C 0 2 9 7 1 8 A F E C 0 2 9 7 1 8 A

1 8 A F E C 0 2 9 7 1 8 A F E C 0 2 9 7 1 8

7 1 8 A F E C 0 2 9 7 1 8 A F E C 0 2 9 7 1

9 7 1 8 A F E C 0 2 9 7 1 8 A F E C 0 2 9 7

2 9 7 1 8 A F E C 0 2 9 7 1 8 A F E C 0 2 9

0 2 9 7 1 8 A F E C 0 2 9 7 1 8 A F E C 0 2

C 0 2 9 7 1 8 A F E C 0 2 9 7 1 8 A F E C 0

E C 0 2 9 7 1 8 A F E C 0 2 9 7 1 8 A F E C

ENCRYPTED / GOVERNED / EVERYWHERE

DATA OBJECT / 001PROTECTION HAS NO PERIMETER

Engineering design.dwgENCRYPTION + ACCESS POLICY

On a deviceIn the cloudWith a partner

01
Protect the file itself.
Attach encryption and access policy to sensitive files in the storage your teams already use.
02
Make access conditional.
Evaluate identity, role, device, and location when protected data is used. A valid login alone is not the whole decision.
03
Keep control as it moves.
Retain the ability to revoke access and investigate file activity, even after a protected file is shared.

THE PADS PRINCIPLE

The file can change hands.
Its protection stays attached.

Explore the research

The scene

Same credential. Same file.
Different outcome.

Watch what happens when someone with a valid login tries to take the file.

85 A2 BF DC F9 16 33 50 74 91 AE CB E8 05 22 3F 63 80 9D BA D7 F4 11 2E 52 6F 8C A9 C6 E3 00 1D 41 5E 7B 98 B5 D2 EF 0C 30 4D 6A 87 A4 C1 DE FB 1F 3C 59 76 93 B0 CD EA 0E 2B 48 65 82 9F BC D9 FD 1A 37 54 71 8E AB C8 EC 09 26 43 60 7D 9A B7 DB F8 15 32 4F 6C 89 A6 CA E7 04 21 3E 5B 78 95 B9 D6 F3 10 2D 4A 67 84 A8 C5 E2 FF 1C 39 56 73 97 B4 D1 EE 0B 28 45 62 86 A3 C0 DD FA 17 34 51 75 92 AF CC E9 06 23 40 64 81 9E BB D8 F5 12 2F 53 70 8D AA C7 E4 01 1E 42 5F 7C 99 B6 D3 F0 0D 31 4E 6B 88 A5 C2 DF FC 20 3D 5A 77 94 B1 CE EB 0F 2C 49 66 83 A0 BD DA FE 1B 38 55 72 8F AC C9 ED 0A 27 44 61 7E 9B B8 DC F9 16 33 50 6D 8A A7 CB E8 05 22 3F 5C 79 96 BA D7 F4 11 2E 4B 68 85 A9 C6 E3 00 1D 3A 57 74 98 B5 D2 EF 0C 29 46 63 87 A4 C1 DE FB 18 35 52 76 93 B0 CD EA 07 24 41 65 82 9F BC D9 F6 13 30 54 71 8E AB C8 E5 02 1F 43 60 7D 9A B7 D4 F1 0E 32 4F 6C 89 A6 C3 E0 FD 21 3E 5B 78 95 B2 CF EC 10 2D 4A 67 84 A1 BE DB FF 1C 39 56 73 90 AD CA EE 0B 28 45 62 7F 9C B9 DD FA 17 34 51 6E 8B A8 CC E9 06 23 40 5D 7A 97 BB D8 F5 12 2F 4C 69 86 AA C7 E4 01 1E 3B 58 75 99 B6 D3 F0 0D 2A 47 64 88 A5 C2 DF FC 19 36 53 77 94 B1 CE EB 08 25 42 66 83 A0 BD DA F7 14 31 55 72 8F AC C9 E6 03 20 44 61 7E 9B B8 D5 F2 0F 33 50 6D 8A A7 C4 E1 FE 22 3F 5C 79 96 B3 D0 ED 11 2E 4B 68 85 A2 BF DC 00 1D 3A 57 74 91 AE CB EF 0C 29 46 63 80 9D BA DE FB 18 35 52 6F 8C A9 CD EA 07 24 41 5E 7B 98 BC D9 F6 13 30 4D 6A 87 AB C8 E5 02 1F 3C 59 76 9A B7 D4 F1 0E 2B 48 65 89 A6 C3 E0 FD 1A 37 54 78 95 B2 CF EC 09 26 43 67 84 A1 BE DB F8 15 32 56 73 90 AD CA E7 04 21 45 62 7F 9C B9 D6 F3 10

attacker@laptopWithout PostAuth

✓ MFA passed · session verified

cp /share/DESIGN.IP ~/stolen/

cat ~/stolen/DESIGN.IP

PROJECT BLUEPRINT · SECTION A-A · ASSEMBLY 02

agent send ~/stolen/DESIGN.IP

agent: summary ready · 4 drawings, 12 parts

Without PostAuth: The login is valid, so every control says yes. The contents copy out, the file exports, and an agent passes it along. All of it leaves in readable form.

attacker@laptopWith PostAuth

✓ MFA passed · session verified

cp /share/DESIGN.IP ~/stolen/

cat ~/stolen/DESIGN.IP

85 A2 BF DC F9 16 33 50 6D 8A A7 C4 E1 FE 1B 38

agent send ~/stolen/DESIGN.IP

agent: denied by file policy · nothing readable

With PostAuth: The login is still valid, and the file still opens. But the file's own policy governs what happens next. Copying follows the rules you set, a stolen copy stays encrypted, and an agent that isn't authorized gets nothing it can read.

Replay Your Incident

02 / THE PLATFORM

One file. Every stage.
Still in your control.

One platform to protect sensitive files, govern access, and see what happens after they’re shared.

01Protect02Govern03Share04Observe

Your files. Their familiar home.

Apply encryption where your data already lives. People keep using their files and applications, with protection attached to the data.

From everyday documents to complex engineering designs.

See it in your environment

F / POSTAUTHILLUSTRATIVE VIEW

Protection in place

Engineering / Product development

DWGTurbine assembly.dwgEncrypted

XLSCost model.xlsxEncrypted

PDFSupplier agreement.pdfEncrypted

Protection follows the data, wherever work takes it.

Make access a policy decision.

Define who can use sensitive files with role-based and location-aware policies. Manage access centrally as teams and responsibilities change.

A valid login is the beginning of the decision.

See it in your environment

F / POSTAUTHILLUSTRATIVE VIEW

Access policy

Engineering intellectual property

01IdentityEngineering team

02LocationApproved locations

03DecisionPolicy evaluated

Protection follows the data, wherever work takes it.

See the story behind every access.

Bring file-access activity into your security workflow. Connect audit logs to your SIEM so teams can investigate with the context they need.

Turn file activity into evidence your team can use.

See it in your environment

F / POSTAUTHILLUSTRATIVE VIEW

File activity

Illustrative audit trail

09:41Engineering team opened fileAllowed

09:43External access attemptedDenied

09:44Partner permission changedRevoked

Protection follows the data, wherever work takes it.

03 / PROTECTION IN PRACTICE

Same file.
Different circumstances.

A file’s location can change. So can the people who need it.
See what stays in your control.

01A file is stolen02A role changes03A partner needs access

ONE PROTECTED FILEILLUSTRATIVE SCENARIO

POSTAUTH
PROTECTED

Engineering
design.dwg

Encryption + policy

WHO HAS THE FILEUnauthorized recipient

Copied outside your organization

PROTECTION ENFORCEDNo readable data

RANSOMWARE

They have the file. Not the data.

An exfiltrated copy stays encrypted. Without authorized access, possession of the file does not make its contents readable.

THE POLICY STAYS WITH THE FILE

Contents remain encrypted.

Explore ransomware protection

ONE PROTECTED FILEILLUSTRATIVE SCENARIO

POSTAUTH
PROTECTED

Engineering
design.dwg

Encryption + policy

WHO HAS THE FILEFormer employee

Permission revoked by your team

PROTECTION ENFORCEDAccess revoked

INSIDER RISK

Their role changed. So did their access.

Revoke permissions centrally when someone leaves or changes roles. Keep control of protected copies without having to retrieve them.

THE POLICY STAYS WITH THE FILE

Access is no longer authorized.

Explore insider threat protection

ONE PROTECTED FILEILLUSTRATIVE SCENARIO

POSTAUTH
PROTECTED

Engineering
design.dwg

Encryption + policy

WHO HAS THE FILEApproved supplier

Working beyond your network

POLICY APPROVEDAuthorized access

PARTNER COLLABORATION

Let the right people keep working.

Share protected files with authorized partners. The file travels with its policy, and you retain the ability to revoke access.

THE POLICY STAYS WITH THE FILE

Access governed by your policy.

Explore third-party protection

04 / CONNECTED BY DESIGN

Keep your stack.
Add persistent protection.

Connect identity, protect files in place, and bring access activity into the tools your security team uses.

PostAuth

Encryption + Access policy + Audit trail

ONE FILE-LEVEL SECURITY LAYER

Your identity

Bring the users and groups you already manage.

Microsoft Entra ID
Okta
Google Workspace

Your storage

Protect files in the places your teams already work.

SharePoint
OneDrive
Box
Egnyte
Network shares

Your security operations

Connect file activity to your security workflow.

Splunk
Datadog

KEY OWNERSHIP

Your data. Your master key.

File encryption keys and file contents are stored separately. Bring your own master key and manage it through your chosen hardware security module.

Discuss your architecture

05 / FROM FIRST FILE TO EVERY TEAM

Start with one team.
Build from there.

Plan your first deployment

01
Scope the first workflow
Choose a team, a set of sensitive folders, and the applications they use. Start with a focused deployment.
02
Connect identity and policy
Use your existing identity provider to assign people to policies and define how protected files can be accessed.
03
Protect, validate, expand
Deploy clients, encrypt the selected files, and validate everyday workflows before extending protection to more teams.

BEFORE YOU GET STARTED

Good questions.
Clear answers.

Have a specific environment in mind?
Talk to our team ↗

Do we have to move our data?

No. PostAuth protects files in your existing storage, including network shares and supported cloud collaboration platforms. Your rollout can begin with selected folders.

Will employees need a new way to open files?

Authorized users continue working with familiar files and applications through the PostAuth client. During a demo, we can walk through your specific applications and workflows.

Can we revoke access after sharing a file?

Yes. Access to protected files can be revoked centrally, including files shared with external partners, without retrieving or reissuing them.

Does this replace identity, DLP, or endpoint security?

PostAuth adds file-level encryption and access control to your existing security architecture. Identity, DLP, and endpoint tools continue to serve their own roles.

Can we start with one department?

Yes. Begin with a focused group and expand incrementally. A demo can help define the data, users, and workflows for your first deployment.

See what happens when protection stays with the file.

Schedule a demo Read the research ↗

A file is born unprotected.

The login opens the door.PADS protects what’s inside.

Protect the file itself.

Make access conditional.

Keep control as it moves.

One file. Every stage.Still in your control.

Your files. Their familiar home.

Protection in place

Make access a policy decision.

Access policy

Collaboration without losing control.

External collaboration

See the story behind every access.

File activity

They have the file. Not the data.

Their role changed. So did their access.

Let the right people keep working.

Keep your stack.Add persistent protection.

Your identity

Your storage

Your security operations

Your data. Your master key.

Start with one team.Build from there.

Scope the first workflow

Connect identity and policy

Protect, validate, expand

Good questions.Clear answers.

See what happens when protection stays with the file.

Cookies on fenixpyre.com

The login opens the door.
PADS protects what’s inside.

One file. Every stage.
Still in your control.

Keep your stack.
Add persistent protection.

Start with one team.
Build from there.

Good questions.
Clear answers.