DLP Watermarks & Cryptographic Selective Wipe
Dynamic identity watermarks, copy/paste and external share controls, 30-day offline self-wipe, and Ed25519 signed wipe proofs.
Three-Layer Access Revocation & Selective Wipe Proof
When an administrator triggers a device wipe or offboards an employee:
1. Server-Side Revocation (Immediate): Access and refresh tokens are revoked in PostgreSQL and active WebSocket connections are terminated.
2. Connected Client Selective Wipe: The client receives device.wipe, shreds the workspace vault's AES-256-GCM key and SQLite database (madar_vault_<vaultId>.db), leaves the Personal Vault untouched, and submits an Ed25519 signature over wipe:<device_id>:<workspace_id> to POST /api/v1/devices/:id/wipe-ack.
3. Offline Monotonic Clock Self-Wipe: If a device remains offline beyond the policy grace window (and past the 30-day ceiling measured by a tamper-resistant monotonic clock), the client automatically executes selective wipe on next launch.