ShardSecure Microshard Technology

Cloud adoption has pushed organizations into a difficult balance between data privacy and data sovereignty, especially when sensitive data is processed by third parties across borders. As data protection laws proliferate globally, compliance failures can trigger substantial financial penalties, and requirements can be contradictory across jurisdictions. The Schrems II judgment and subsequent EDPB recommendations sharpen this challenge by stating that processing EU personal data “in the clear” outside the EU is not permitted and that legal safeguards like Standard Contractual Clauses are insufficient without supplementary technical measures. The EDPB highlights three primary technical approaches: strong encryption with exporter-held keys, pseudonymization prior to transfer, and split processing across independent importers in different jurisdictions.

ShardSecure’s patented Microshard technology is presented as a technical response, aiming to desensitize data at rest by compressing, shredding data into microshards (as small as four bytes), mixing them into multiple logical containers, optionally adding decoys, removing metadata, and distributing containers across multiple customer-controlled storage locations (multi-cloud, multi-region, or hybrid). Reassembly is performed in real time and in parallel, using securely stored, distributed reassembly instructions; decoys are ignored. The approach avoids traditional reversible cryptographic computation and reduces reliance on encryption key management, while adding integrity checks that can detect tampering and automatically reconstruct altered fragments.

Mapped to an information lifecycle framework, Microshard is positioned under “Secure” controls for confidentiality and integrity in transit and at rest. Evaluated against EDPB use cases, it best aligns with split/multi-party processing (Use Case 5), can support storage/backup scenarios if the microsharding cluster remains under EU jurisdiction (Use Case 1), and can complement encryption or pseudonymization but does not replace pseudonymization. Key challenges include lack of independent certification (e.g., FIPS/Common Criteria), absence of confidential computing support, and practical limitations where applications (e.g., SecureDrive for Microsoft 365) reassemble data on web servers during editing sessions.

• Data protection and data sovereignty laws and regulations are growing worldwide, and noncompliance can lead to substantial financial penalties.
• The Schrems II judgment and EDPB recommendations state that processing EU personal data in the clear by processors outside the EU is not permitted and SCCs alone are insufficient.
• The EDPB identifies three major supplementary technical measures: encryption, pseudonymization, and split processing across independent importers.
• On October 7, 2022, the US issued an Executive Order on Enhancing Safeguards for United States Intelligence Activities.
• ShardSecure is headquartered in New York and has offices in Sweden and Germany.
• Microshard technology compresses data and shreds it into fragments as small as four bytes.
• Logical containers each hold only a subset of microshards, and no single container contains all the data.
• File names, file extensions, and metadata are removed as part of the containerization process.
• ShardSecure uses TLS 1.3 to protect data in transit.
• SecureDrive integrates with Office Online apps, and editing a file causes data to be reassembled on Microsoft web servers for at least the duration of the session.

• “Data is the most important business asset of the modern organization, and it needs to be protected against unauthorized access as well as ransomware and loss.”
• “This judgement and the EDPB recommendations make it clear that processing the personal data in the clear by cloud service providers and other data processors located outside of the EU is not permitted”
• “Organizations must implement supplementary technical measures to protect that data.”
• “Microshard technology implements a three-step process that consists of shredding, mixing, and distributing data across multiple storage locations”
• “These are tiny pieces of data – as small as four bytes – that are too small to contain sensitive data.”
• “The reassembly process ignores any decoy data and returns a complete logical unit of data (file or bucket) to the requesting application for the user.”
• “ShardSecure technology does not use any mathematical computation that can be reversed or decoded.”
• “It is important to remember that information protection must cover the whole of the information lifecycle and requires a wide range of different types of controls.”
• “For two of these the EDPB is ‘incapable of envisioning an effective technical measure to prevent that access from infringing on data subject rights in this use case.’”
• “This is precisely the way in which the ShardSecure virtual cluster can be configured to work.”