Post-merger data sovereignty: protect the file, not the network, when segmentation is impossible
A large benefits-administration and financial-services company. Outcome verified
The problem
A large financial-services company had acquired an offshore affiliate and needed staff there to work daily on data that US law and customer contracts kept under US control. Nobody could say which files were protected or how they moved, the merger would give offshore staff full accounts in a shared directory, and segmentation was off the table.
Why it mattered
Protected personal, health and cardholder data could land on non-US workstations with no technical control enforcing policy: a regulatory and contractual breach at integration.
What we did
Vizius reframed the question from 'where is the data' to 'what travels with the file': label and encrypt in-scope files with US-held keys, and let identity and session context decide who can open them. When pilots showed the tools did not integrate as planned, Vizius led documented pivots rather than force a design that would not hold.
What changed
The client finished with a tested understanding of what could be enforced technically, an explicit residual-risk position, a prioritized gap list with owners, and an 18-to-24-month re-architecture path. It closed on time and won the follow-on engagement.
- Financial services
- Enterprise company
- Data sovereignty / GDPR
- HIPAA
- PCI DSS