EpositBox is building a new approach to sensitive-data custody, helping organizations control access, preserve lineage and verify the integrity of critical records across applications, infrastructure and AI-driven workflows.
Designed to complement existing applications and cloud environments.
The challenge
Sensitive information is copied, moved and processed across applications, databases, cloud services, backups, vendors and AI workflows. Security teams need more than a policy or an audit log. They need a reliable way to govern custody and verify what happened.
When a critical record is questioned, can you demonstrate its history and integrity?See the EpositBox approach →
Permissions and identities can vary across systems and data stores.
Sensitive records may spread into backups, exports, logs and integrations.
It can be difficult to reconstruct where data moved and how it was handled.
Organizations need defensible ways to verify integrity and document access.
The platform
EpositBox brings together a custody architecture and an identity-and-access foundation to support controlled handling of sensitive data and verifiable records of critical activity.
Custody architecture
The evidentiary custody platform designed to connect controlled data handling with lineage, integrity checks and verifiable evidence, without requiring organizations to replace every application.
Explore the architecture →Identity & access engine
Zero-Knowledge Identity and Access Engine. The STRINGS foundation for identity-aware authorization and controlled machine-to-machine access to sensitive records.
Understand the access model →The engine
'%3e%3cpath%20d='M8.8%2014.88H4.448V4.768H.128V1.6H13.152V4.768H8.8V14.88Z'/%3e%3cpath%20d='M18.624%2014.88H14.656V1.6H18.208L23.136%209.056%2027.968%201.6H31.488L31.552%2014.88H27.584L27.52%208.256%2024.064%2013.632H22.144L18.624%208.448V14.88Z'/%3e%3c/g%3e%3c/g%3e%3cpath%20fill='%238BD790'%20d='M94.5%2080H74.9V10H94.5V39.1L121.6%2010H143.4L114.9%2041L144.9%2080H121.9L101.8%2054.6%2094.5%2062.5V80Z'/%3e%3cpath%20fill='%2357B660'%20d='M94.5%2039.1L121.6%2010H143.4L114.9%2041Z'/%3e%3cpath%20fill='%2357B660'%20d='M114.9%2041L144.9%2080H121.9L101.8%2054.6%2094.5%2062.5Z'/%3e%3cpath%20fill='%23000000'%20fill-opacity='0.22'%20d='M94.5%2048.8L108.2%2041.5%2094.5%2058.2Z'/%3e%3c/svg%3e)
ZKIAM™ is the zero-knowledge identity and access engine the STRINGS system runs on.
STRINGS does not replace your applications or your cloud. It sits underneath them as the layer where custody, lineage, and proof are enforced by architecture rather than policy.
Access to a sealed record is machine-to-machine and cryptographically proven, without exposing the record to prove it. No standing privileges, no shared credentials, no human path to the underlying data. Every access decision becomes part of the evidence rather than a gap in it.
How it works
A conceptual lifecycle for governing a sensitive record from authorization through later verification.
01 / Classify
Determine the record, sensitivity and applicable handling requirements.
02 / Authorize
Evaluate identity, entitlement and the requested operation.
03 / Protect
Apply appropriate cryptographic controls to support integrity verification.
04 / Trace
Maintain relevant lineage and evidence records across the workflow.
05 / Verify
Verify integrity and present the available history for review.
Solutions
Focus on high-value use cases where sensitive information, accountability and evidence matter.
Support controlled custody and integrity verification for sensitive customer records, financial documents and transaction-related evidence.
Discuss financial use cases →Help govern sensitive patient and insurance information while supporting traceability and verification across complex data workflows.
Discuss healthcare use cases →Explore identity-aware access to sensitive data and traceable evidence for machine-to-machine and AI-agent interactions.
Discuss AI governance →Architecture principles
Sensitive documents and operational data can remain off-chain. Where appropriate, cryptographic hashes, timestamps or verification metadata may be anchored to a ledger to support independent integrity checks. The architecture should use the right mechanism for each requirement, not blockchain for its own sake.
Research & insights
Explore an evidence-based research program covering financial and healthcare breaches, affected individuals, attack patterns, litigation and regulatory outcomes.
EpositBox research series
A structured view of incidents, sensitive data exposure and the business consequences of weak custody, access or evidence controls.
EpositBox · About the Numbers
Data breaches are no longer isolated IT incidents. They can become legal, financial, operational and reputational events that continue long after the initial compromise.
3,000+
U.S. data-breach class actions were reported in 2025 in some industry counts, illustrating the scale of litigation risk surrounding compromised data.
Available litigation analyses show a substantial increase in breach-related class actions. Exact totals vary by methodology, including whether related cases and privacy claims are counted separately.
~604
Reported breach class actions, 2022
~1,320
Reported breach class actions, 2023
~1,488
Reported breach class actions, 2024
~1,822
Reported breach class actions, 2025
The economic exposure can extend across litigation, regulatory response, notification, credit monitoring, remediation, customer support, business interruption, security investments and reputational damage.
Selected high-profile examples demonstrate the potential scale of post-breach litigation and settlement exposure.
| Company | Approx. records affected | Reported settlement / resolution |
|---|---|---|
| Equifax | 147 million | $700M |
| T-Mobile | 76 million | $350M + $150M security investment |
| AT&T | — | $177M |
| Yahoo | — | $117.5M |
| Marriott | — | $52M |
| MGM Resorts | 37 million | $45M |
| Anthem | 79 million | $115M |
Based on the settlement figures compiled in our analysis, the selected top-10 breach settlements represented approximately $719.2M in 2022, $515.8M in 2023, $593.2M in 2024 and $515.8M in 2025.
The more sensitive information an organization stores, copies, transfers and shares, the greater the potential blast radius when that information is compromised.
Organizations frequently have to spend heavily on investigation, remediation, monitoring, infrastructure changes and enhanced security controls after an incident.
Organizations increasingly need to demonstrate not only that data was protected, but where it came from, who accessed it, what happened to it and whether its integrity can be established.
EpositBox is designed around controlled custody, lineage and proof, helping organizations reduce the opportunity for unauthorized access and improve their ability to demonstrate what happened to critical data.
Research note: Breach counts and litigation totals vary by source and methodology. Settlement amounts may represent class-action settlements, regulatory resolutions, security commitments, or combinations thereof.
About EpositBox
EpositBox is focused on a more accountable approach to sensitive-data custody, access and verification.
Tell us about your data protection, access governance or evidence requirements. Let's explore whether the EpositBox approach fits your environment.