TRUSTED
On an enrolled device
Device Trust is valid, posture is compliant, and the user identity is current. The key is released for that open, and the file behaves like any other file in the native application.
DATA PROTECTION
Protect data where users handle it and keep it unreadable off trusted devices.
Oten Data Protection extends Oten Protector policy to endpoint channels such as removable media, clipboard, capture, and thick-client workflows where data may be available in plaintext to an authorized application or user. The target design inverts conventional data loss prevention: sensitive files stay persistently encrypted, and the decryption key is released only to qualified devices under Protector policy, so a file that leaves the organization carries no usable key.
System role: Oten Endpoint DLP Agent + Oten Protector
Evaluation depends on: Requires platform-specific endpoint interception, persistent file encryption, HSM-backed key management, Protector policy integration, privacy review, and explicit offline behavior.
POLICYOten ProtectorClassify + Govern
CONTEXTDevice + ResourceAccess correlation
PEPEndpoint DLPPlatform-specific
DECISIONAllow · Warn · BlockUser-visible
PROTECTION MODEL
A file that leaves the organization carries no usable key.
Conventional data loss prevention tries to block every escape path and still misses channels. The target design inverts the problem: sensitive files are packaged as ciphertext, and the decryption key is released only to a qualified, enrolled device.
UNTRUSTED
Anywhere else
No device certificate, no authenticated request, and no key. The file is an encrypted container of meaningless bytes, with nothing to brute force because the key never travels with the file.
OWNERSHIP
Policy and endpoint enforcement have distinct owners.
Oten Protector
Owns data policy, classifiers and profiles, incident workflow, governance, and analytics.
Oten Endpoint DLP
Intercepts supported local actions, performs bounded inspection, enforces cached policy, and explains decisions to the user.
Access Control Plane
Provides device and resource context, assignment, and cross-product audit correlation as the architecture matures.
THREE LAYERS
Three layers of protection, one layer of guarantee.
The design does not promise to block every channel. It is built so that a missed block is no longer a disaster, because the guarantee layer holds independently.
REDUCTION
Layer 1: Egress control
Removable storage, clipboard, and AirDrop are controlled on the device; email is inspected at Oten Gateway; generative-AI destinations are identified through the ZTNA network layer; print, share, and upload are gated per platform and application. This layer reduces accidental leaks, but the product does not depend on it.
GUARANTEE
Layer 2: Persistent encryption
Sensitive files are packaged in the encrypted .ogcx container using AES-256-GCM. The decryption key is released only when the device is enrolled, the user identity is valid, and the security posture is compliant, checked again on every open.
SANCTIONED EXIT
Layer 3: Declassification
The only supported path for sharing outside the organization. Files leave through an approval workflow as watermarked, sanitized outputs, and every export is recorded in a tamper-evident audit ledger.
REVOCATION
What revocation means, case by case.
Guarantees are stated precisely rather than impressively. Revocation is bounded by tier, connectivity, and the open session in flight.
Restricted tier, online
The next open is blocked as soon as revocation propagates to the key service.
Confidential tier, device online
The next open is blocked when the device next requests the key.
Confidential tier, offline with cached access
Access continues only until the offline grant expires, configurable per group with a default grace window.
File already open in an application
The current session is not force-closed in this release; the next open is blocked.
Copy exported through approval
Cannot be recalled, which is why it requires approval, carries a watermark, and is fully audited.
ARCHITECTURE
An identical core, a replaceable experience layer.
The most important architectural decision is to separate the security guarantee from the user experience, so each can evolve at its own pace without putting the other at risk.
GUARANTEE
Core tier: identical on every platform
The encryption format, HSM-backed key management, and key-release policy are identical on Windows, macOS, and Linux. This is where every security commitment is enforced, written once and audited once.
WINDOW
Experience tier: native per platform, replaceable
Each operating system gets its most natural interface into the container. This layer can be changed, upgraded, or removed without disturbing the guarantee underneath. macOS uses File Provider, Windows uses a minifilter, and Linux uses an overlay filesystem tracked for platform support.
- Change without risk: each platform experience upgrades independently, without touching audited security code.
- Ship-all, activate by policy: every module ships in one installer and is toggled by Control Plane policy, so large rollouts need no reinstalls.
- Built on a proven foundation: data protection shares the Device Trust, policy engine, and ZTNA infrastructure of Oten Endpoint rather than standing as a separate product.
DECISION UX
Data controls should explain the decision without leaking content.
Allow
Avoid unnecessary friction; record only the evidence required by policy.
Warn
Name the safe data category, destination, and consequence, then require explicit acknowledgement.
Justify
Collect a structured business reason without sending sensitive content to analytics.
Block
Show a policy-safe reason and a legitimate remediation or exception path.
Protect
Explain the resulting file behavior, recipient or device condition, and recovery path.
SANCTIONED SHARING
The one supported path for sharing data outside.
When a file must leave the organization, the declassification workflow turns a risky ad-hoc send into a reviewed, time-limited, and audited export.
Request
The user uploads the file to the portal, names the recipient, and records a business justification.
Approve
Approvers sign off based on the sensitivity tier, one or two approvers depending on classification, and the decision is written to the audit trail.
Deliver
The system issues a one-time, password-protected download link with an expiry. Files are delivered as watermarked, sanitized outputs, and the password travels separately through Oten Pass.
PRIVACY
Inspection is constrained by data minimization and governance.
- Minimize content sent off-device and separate operational telemetry from security evidence.
- Redact or mask evidence based on role; do not log clipboard or file content by default.
- Encrypt offline policy and verdict caches, bind them to version and TTL, and define deterministic conflict behavior.
- Provide user notification and complete legal, privacy, and employee-governance review for monitoring and recording.
FAQ
Questions security and platform teams ask first.
Does endpoint DLP break end-to-end encryption?
No. A legitimate endpoint integration may inspect an authorized plaintext boundary before encryption or after decryption. The site must not imply that Oten defeats the cryptographic protocol itself.
Is the decryption key stored with the file?
No. Sensitive files are packaged as ciphertext, and the key is released only to a qualified, enrolled device under Protector policy, re-checked on every open. A file without an authenticated device carries no usable key.
Are all data channels supported on every operating system?
No. Clipboard, capture, file, removable-media, print, and application hooks vary by operating system and API. Each enforcement channel has an explicit platform and application support contract.
Does audit require storing user content?
Not by default. Audit should preserve the minimum policy, category, decision, source, destination, and enforcement evidence required for the use case, with role-based access and retention controls.
Next in Oten Access
Continue the technical evaluation.
Extend data policy to the endpoint without hiding platform limits.
Review the Agent boundary, the encryption and key-release model, and the security dependencies for data-in-use enforcement.