Every program
SIEM and DetectionSecurity AutomationManaged ServicesZero TrustIdentity and AccessAI SecurityData ProtectionApplication SecurityCloud SecurityRisk and ComplianceStrategy and AdvisorySee all security programsthe team your security team calls.
people, agents and data
We find it, label it and put controls where it moves.
what the program covers
be honest, now
Sensitive data sits in dozens of systems, and few teams can say where, who touches it or whether it is protected. The auditor asks. The answer is a shrug.
1.
Customer records, IP and financials sit in on prem databases, cloud storage, SaaS apps and backups. Shadow IT hides more of it. Then the auditor asks where customer personal data lives and the honest answer is that nobody is sure.
2.
Tags and naming conventions depend on people, and people miss things. Sensitive data ends up unlabelled under ordinary access controls, and a manual process cannot show an auditor that every record was classified.
3.
Some data is encrypted in some regions, with keys spread across AWS KMS, Azure Key Vault, HashiCorp Vault and on prem HSMs. Some data is not encrypted because nobody knew it had to be. A missed key rotation turns into a compliance finding.
4.
Employees, contractors and service accounts hold standing access to sensitive stores. Reviews happen quarterly or yearly, and they are incomplete. A compromised account can pull a lot of data before anyone notices, and a request from a person for their own data takes weeks because nobody can list every system that holds it.
see it, label it, lock it
Each pillar covers one part of the job. Together they make sensitive data easy to find, labelled, encrypted, governed and hard to walk out the door.
pillar 1 of 6
Discovery engines scan cloud accounts, databases, file shares and SaaS apps for sensitive data patterns. You get a searchable inventory and a map of how data moves from source to destination.
pillar 2 of 6
Automated classification labels data by sensitivity and compliance scope. The rules apply to new data as it arrives, so labels stay accurate as data moves.
pillar 3 of 6
An encryption strategy for data at rest and in transit across cloud providers and HSMs. We handle key rotation, separation of duties for key access and audit logging of every key operation.
pillar 4 of 6
Least privilege policies, access removed when people leave and every access attempt logged. Governance covers service accounts and APIs, not only human users.
pillar 5 of 6
Secrets vaults for API keys, database passwords and authentication tokens. Secrets rotate automatically, stay out of code and every access is audited.
pillar 6 of 6
Data loss prevention policies that stop sensitive data going to personal cloud storage, email or the printer. Attempts to move data out raise an alert for investigation.
one level at a time
Nobody starts at the top. Pick the level that sounds like your Monday morning and we plan the climb from there.
Some data is encrypted in some places, and nobody has the full picture of where sensitive data sits. Classification is minimal and audits are done by hand.
Data Assessment
Discovery scans your infrastructure continuously and classification tags sensitive data automatically. The inventory is searchable, so "where is customer personal data stored?" has an answer.
Discovery Deployment
Encryption reaches the sensitive data with keys managed in one place. Access needs approval, reviews are automated and you can see who touched what, and when.
Governance and Encryption
Sensitive data is found, classified on the way in, encrypted by default, governed by policy and watched for exfiltration. Compliance reporting draws on the same data and is ready when someone asks.
Managed Data Protection
pick your door
Three common ways into a data protection program.
first
Patient records spread across clinics, older records systems and cloud imaging. We find the protected health information wherever it sits, classify it, encrypt the stores and limit clinicians to the records they need for care.
second
A platform serving EU customers gets a steady flow of right of access requests. We map the repositories, tag personal data and set up a workflow that finds one person's data, exports it securely and keeps the evidence.
third
Database credentials and API keys turn up hardcoded in application code or on a public repository. We scan for secrets, rotate what was exposed and add pre commit checks so the next one is caught before it ships.
the service pages
Data discovery, classification, privacy assessments, and encryption engineering.
Start with an assessment. We will show you where sensitive data lives and what protects it today.
Mapped to GDPR, CCPA, PIPEDA, PCI DSS and HIPAA.