.svg){kind=icon}
FileGrant
Securely store, share, and manage your files with an advanced, easy-to-use, and highly customizable platform
Data Loss Prevention file-centric
Your company's sensitive data stays protected even when it leaves the perimeter, because protection lives inside the file and travels with it wherever it goes
What Data Loss Prevention is, and why it needs a new approach
Data Loss Prevention (DLP) is the set of technologies and policies that prevent the leak, loss or unauthorized use of sensitive data: contracts, customer records, strategic plans, source code. Traditional DLP was built to stop data leaving through a few identifiable channels, back when files lived on company servers. Today a document moves from PC to cloud, to email, to chat, to AI platforms: chasing every channel produces false positives, slows the business and depends on users behaving correctly. It is no coincidence that, according to the Verizon DBIR 2026, the human element is present in 62% of breaches.
CyberGrant moves past this limit by bringing protection inside the file: native encryption, automatic classification, unified governance. We call it DLP 2.0, a file-centric approach where data is no longer born vulnerable and then chased, it is born protected. We explained why the traditional model no longer holds in Traditional DLP is obsolete: the limits exposed by NIS2.
DIGITAL ASSET PROTECTION
Protect intellectual property from insider and third-party exfiltration
Innovation, know-how, contracts, research data: these are the assets that set you apart from competitors, and the most exposed to exfiltration, because they live in documents that move every day between departments, suppliers, partners and devices. The hardest threat to catch is not the external attack but the insider with legitimate access: in the Waymo-Uber case, an engineer transferred about 14,000 confidential files (9.7 GB) before leaving the company.
With the file-centric approach of FileGrant, every document enters an encrypted logical perimeter, accessible only to those with the correct permissions, with RBAC, a full audit trail and post-share revocation: access can be withdrawn even after sending, even on an external system. A mass download during offboarding triggers real-time alerts, not a forensic analysis months later.
AUTOMATIC CLASSIFICATION
DLP 2.0 eliminates manual classification
Effective data protection starts with recognizing what actually matters. Identifying sensitive information and assigning the right confidentiality level lets you apply the most effective measures, starting with encryption. Asking the user to do this by hand is the first cause of failure in traditional DLP.
CyberGrant's automatic classification relies on a private, on-premise AI, never exposed to public clouds. The AI analyzes content as it is created or modified, recognizes sensitive data, and applies tags, access rules and encryption consistent with company policy. Once applied, tags take priority over the user's actions: if a document is marked as non-downloadable, no one can download it. This is the shift from DLP that asks the user to do security to DLP that does it for them, governed by AIGrant.
TRANSPARENT ENCRYPTION
Native, quantum-safe encryption that's stays invisible to whoever works with the document
Recognizing sensitive data is the first step. Protecting it is the second, and encryption is what makes it possible. Without encryption, every tag and every policy stays a label: useful for knowing what matters, useless for preventing exfiltration.
Our solutions apply encryption natively: every file is protected at creation or upload with the CRYSTALS-Kyber algorithm, NIST standard FIPS 203 (ML-KEM) since August 2024, through the Lock&Go encrypted-download technology. This also answers the "harvest now, decrypt later" logic, where encrypted data collected today could be decrypted in the future. For the user it is invisible: no keys to manage, no extra passwords, no app to open.
CLOUD PROTECTION
Protect data in cloud storage and sharing services
Sharing files in the cloud is convenient, but it moves data outside the company's direct control. Applying encryption directly to the file, before it is even uploaded, ensures data stays protected even in the event of credential theft or unauthorized access on the provider side. The recurring blind spot is personal data left in cleartext at rest: in the 2026 Booking, Eataly and Trenitalia cases, once the boundary was crossed the records were readable and immediately usable for tailored phishing.
FileGrant applies encryption directly to the file and integrates with the main cloud storage and sharing services; RemoteGrant extends the same transparent protection to company PCs and endpoints. Even in the event of credential theft or unauthorized access on the provider side, the record stays encrypted and unreadable outside the authorized context. Whoever crosses the perimeter finds data they cannot use.
ANTI-PHISHING
Control web access and protect browsing
Allowing the use of online tools without exposing confidential information is a daily challenge. Advanced browsing protection prevents the unauthorized download of sensitive data and blocks access to dangerous or deceptive sites in real time.
On the AI front, anti-AI scraping protection prevents confidential content from being ingested by generative AI platforms. Endpoint and remote-access protection, with transparent encryption on company PCs and cloud, is handled by RemoteGrant.
White Paper
Gain full control of your data with enterprise-grade DLP
It’s not just about stopping breaches. It’s about protecting IP, customer trust, and business continuity.
FAQ
What is Data Loss Prevention (DLP)?
Data Loss Prevention is the set of technologies and policies that prevent the leak, loss or unauthorized use of sensitive data, such as contracts, customer records and intellectual property. Traditional DLP controls exit channels; the file-centric approach protects the file directly.
What is the difference between traditional DLP and file-centric DLP 2.0?
Traditional DLP chases data along exit channels (email, USB, cloud, web) and depends on manual classification and user behavior. File-centric DLP 2.0 encrypts the data at creation and classifies it automatically: protection stays in the file even outside the network, reducing false positives and operational load.
Is data encryption mandatory under NIS2 and GDPR?
No rule mandates a specific algorithm, but both require protection appropriate to the risk. The GDPR (Regulation EU 2016/679, Article 32) considers encryption an appropriate measure for personal data. NIS2 (Legislative Decree 138/2024) makes it an explicit requirement for essential and important entities.
What is quantum-safe encryption and why does it matter now?
It is cryptography designed to withstand attacks from future quantum computers. It matters now because of the "harvest now, decrypt later" logic: encrypted data collected today could be decrypted in the future. CyberGrant uses CRYSTALS-Kyber, the NIST standard FIPS 203 (ML-KEM), since August 2024.
Can I use FileGrant together with SharePoint, OneDrive or Microsoft Purview?
Yes. If you already have SharePoint or OneDrive, FileGrant integrates with them and extends their protection: it adds persistent encryption, granular access control, post-share revocation and quantum-safe protection, following the file across any channel. Likewise, AIGrant sits alongside Microsoft Purview and Copilot as a private AI. You keep your existing stack and close the protection gap the perimeter alone leaves open.
How does file-centric DLP protect against insiders with legitimate access?
Protection lives in the file: RBAC and granular permissions ensure a compromised account or an insider cannot open the entire archive, while audit trail and real-time alerts flag mass downloads. Even if the file is copied or taken outside, it stays encrypted and unreadable beyond the authorized context.
Book a Demo
Discover how DLP secures your business