KLEARIS / ZERO TRUST FILE SECURITY (CONTENT DISARM & RECONSTRUCTION)
Financial Forensics
Treats every incoming file as untrusted: identifies its true type, removes active content such as macros, scripts, embedded objects and links, and rebuilds a clean file to the format specification in milliseconds — without relying on signatures or sandbox verdicts.
Operational fit
Cleaning e-mail attachments, downloads, uploads and cross-network file transfers before they reach analysts or evidence systems.
Specifications
| File coverage | 104 file types across 7 families |
|---|---|
| Limits | Up to 4 GB per file · ~20,000 files per archive · 50 nesting levels |
| Speed | ~196 ms for a 10 KB file |
| Deployment | On-premise, air-gapped and cross-domain |
Approach — Content Disarm & Reconstruction
Every file is treated as untrusted. Instead of asking whether a file is malicious, Klearis rebuilds it so that only safe content remains.
How it works — three steps, every file
- Identify — reads the file structure and checks every component against the file-type specification; disguised files are caught here.
- Disarm — removes every element that can execute or call out: macros, auto-run triggers, scripts, embedded objects and files, external links and references, hidden content, metadata.
- Rebuild — writes a new file from the safe content on a clean template; it looks and works like the original.
Platform capabilities
- 104 supported file types across 7 families: Office, PDF and text, images, video and audio, archives, e-mail and other.
- Largest single file 4 GB, configurable per policy; about 20,000 files inside one archive; 50 levels of nested archives.
- Channels: mail gateway, Outlook add-in, browser extension, ICAP proxy, REST API, server agent for watched folders, web interface, desktop client.
- Optional modules: macro and URL allow-lists, built-in antivirus and YARA rules, plain-language macro analysis, allow or block by signer or country of origin, advanced indicator analysis.
- Enterprise fit: LDAP / Active Directory, single sign-on (SAML, OAuth 2.0, OpenID Connect, Kerberos) with MFA, SIEM log streaming (CEF, LEEF, JSON), per-file-type and per-group policies.
Performance (supplier figures)
About 79,000 e-mails sanitised per day on one mail-gateway reference set-up; ~196 ms for a 10 KB file; ~2 s for a 10 MB file.
Deployment
On-premise, fully offline or air-gapped, cross-domain between network tiers, and isolated or OT networks.
Audit record
Every file comes with a report: before and after hashes, processing time, and each removed element explained in plain language. The original is retained for a set period.
Licensing
By number of files sanitised per month, all channels and modules included.