DataFlow
DataFlow uses AI to identify sensitive data, map where it lives and how it moves, and show you where exposure is greatest. It tells you what to protect first, without a time-intensive classification project that delays protection. And it works without disrupting the way your people work.
A label can underestimate sensitivity.A better label helps you prioritize.Even a missing label leaves encryption unchanged.
Protection doesn’t depend on perfect classification.With PostAuth, encryption is applied at the folder level, independently of the file’s classification.
Find with DataFlow.The dependency
Traditional DLP workflows use classification to determine which policies apply, and many DRM approaches use labels the same way. That creates a dependency: if the classification is wrong, the protection outcome can be wrong, too. AI can improve classification, but no classifier is perfect, and data never stops changing.
PostAuth separates the two. DataFlow uses AI and activity context to reveal risk and prioritize where to begin. DataProtect encrypts folders independently of those classifications, so you get strong protection without adding friction to the business. Employees open, edit, and save files in their native applications exactly as before.
When labels get it wrong
Four ways a label can fail.
One protection boundary that doesn’t.
Sensitivity underestimated
board-minutes.docx
GeneralLabel-dependent protection
Sensitive data may be missed by policy
With PostAuth
Files in protected folders remain encrypted
Sensitivity overstated
team-lunch.pdf
RestrictedLabel-dependent protection
Restrictions and alerts disrupt legitimate work
With PostAuth
Nothing is blocked. Users work as usual
No classification applied
export-0419.csv
No labelLabel-dependent protection
Files may fall outside intended controls
With PostAuth
Files in protected folders remain encrypted
The file changed. The label didn’t.
pricing-model.xlsx
Public · 2024Label-dependent protection
Policies rely on outdated labels
With PostAuth
Label changes don’t affect encryption
The label sets the priority.
The folder sets the protection.
Illustrative files and labels. PostAuth outcomes apply to files in protected folders.
What a mistake costs
No classifier is perfect, including ours, so the useful question is what a mistake costs. With PostAuth, a mistake is a sequencing error, not a security failure or a work stoppage:
Labeled too high: a folder is protected a little earlier than needed. Nobody notices, so protecting low-sensitivity data creates no business friction.
Labeled too low: a folder could sit lower in the queue than it should. This is the one real cost, and it’s a delay, not a gap in protected data.
You can take the risk out of “too low” without waiting for better labels:
Protect broadly, then refine. Encrypt by department or share, so a missed label never leaves a folder uncovered.
DataFlow / DataProtect
Labeled too highProtected earlier
Earlier in the queue. No change to how people work.
Labeled too lowCovered broadly
Lower in the queue. Already covered by its parent share.
Every classifier makes mistakes.
PostAuth is built so those mistakes don’t determine whether your data is safe.
Two sensors
Windows and macOS · Local drives · OneDrive · Egnyte · Network shares · USB
Chrome · Edge · Arc · Brave · Installs with the endpoint sensor
Discovery to protection
Track file activity across devices, applications, and the web.
Identify sensitive data and risky behavior.
Surface the users, devices, folders, and systems that warrant attention first.
Deploy DataProtect to prioritize folders and apply encryption.
Classification informs the order of operations. It isn’t a prerequisite for protection.
In practice
Using stolen credentials, an attacker reaches finance and HR folders. If those folders are already encrypted with DataProtect, the files stay protected even though the attacker is on the server.
DataFlow spots sensitive customer data moving to an AI tool or personal account and prioritizes the relevant folders. Once protected, subsequent copies remain encrypted.
A contracts folder is labeled “general” but holds sensitive information. If the legal folder is already protected, the wrong label doesn’t undo its encryption.
DataFlow correlates archiving source code, copying files to USB, and sending files to a personal account. Files in encrypted folders stay protected through those channels.
FAQ
No. You can protect folders directly with DataProtect. DataFlow helps you understand where the risk is and what to protect first.
No. DataFlow discovers sensitive data, observes activity, and prioritizes exposure. DataProtect applies encryption at the folder level, independently of classification.
No. Users open and edit protected files in their native applications as they always have, so protecting more than you strictly needed doesn’t create friction.
DataFlow shows you where sensitive data lives, how it moves, and where to prioritize. DataProtect makes classification independent of the protection boundary.
Your labels will always improve. Your protection doesn’t have to wait.