Wise Resec Cloud — Zero-Trust File Sanitization Platform

How it works

Three steps. Zero trust.

No scanning queues, no sandbox delays, no “probably safe”. A deterministic pipeline that treats every file as hostile.

Intercept

Files arrive via portal, REST API or integrations — straight into an isolated, per-customer vault. The original never touches your network.

Rebuild

The Resec engine renders the file and reconstructs it from scratch, keeping only components verified as safe. Macros, scripts and embedded payloads simply don’t make the cut.

Deliver & prove

You get a visually identical, fully functional file in seconds — plus a signed report of exactly what was removed, for every file, every time.

Prevention, not detection

Detection asks “is it bad?”. We don’t ask.

Antivirus and sandboxes search for known evil — and miss what they’ve never seen. Reconstruction makes the question irrelevant.

Detection-based

Antivirus & Sandboxing

Hunts for known signatures — zero-days walk right through
Sandboxes add minutes of latency per file
Evasion techniques defeat dynamic analysis
“Clean” verdict is a probability, not a guarantee

Reconstruction-based

Resec Cloud CDR

Rebuilds every file from verified-safe components only
Unknown threats removed by design — no signatures needed
Seconds per file, at any scale
Deterministic outcome with a full evidence report

The platform

Enterprise-grade, from the first file

True tenant isolation

Dedicated storage container, encryption scope and partition per customer. Your files are never shared, scanned-in-public, or used to train anything.

API-first

Clean REST API with direct-to-storage uploads, idempotent commits and per-file reports. Integrate in an afternoon.

Signed webhooks

HMAC-signed notifications the moment a file completes — with automatic retries and dead-letter handling.

Instant verdicts

Hash reputation cache returns known results in milliseconds — versioned by engine and policy so it’s never stale.

Audit & compliance

Every upload, download and policy change logged per tenant. Built for ISO 27001 / SOC 2 / GDPR programs, with offboarding crypto-shredding.

Elastic by design

The engine pool scales with your queue — burst to thousands of files, scale to zero when idle. You never pay for waiting.

Developers

Four calls. Files sanitized.

Request a slot, upload straight to storage, commit, collect the clean file. That’s the whole integration.

Direct-to-storage uploads — no proxy bottleneck

Idempotent commits and deterministic job states

HMAC-signed webhooks for completion events

Per-file sanitization report — what was removed and why

# 1 — request an upload slot
curl -X POST https://api.resec.cloud/v1/files \
  -H "x-api-key: rck_•••" \
  -d '{"fileName":"contract.docx"}'

→ { "jobId": "job_8f3a…", "uploadUrl": "https://…sas" }

# 2 — upload the bytes, 3 — commit
curl -X PUT "$uploadUrl" --data-binary @contract.docx
curl -X POST …/v1/files/job_8f3a…/commit

# 4 — download the rebuilt file
curl -L …/v1/files/job_8f3a…/download -o contract.docx

→ verdict: sanitized · removed: [vba-macro] · 2.1s

FAQ

Questions, answered

No. The engine renders the original and reconstructs a visually identical, fully functional file in the same format. What’s removed is what shouldn’t be there: macros, scripts, embedded executables and other active content.

By default it’s deleted after processing. Enterprise tenants can opt in to retain originals in an isolated, immutable quarantine for forensics.

Never. Every tenant gets an isolated storage container and database partition. Files are not shared with other customers, not published to public reputation feeds, and not used for training.

Office documents (Word, Excel, PowerPoint incl. macro-enabled), PDF, images, text and archives — with true-type verification, so a renamed executable never slips through.

In Microsoft Azure, in your chosen region, encrypted at rest and in transit. Enterprise plans add customer-managed keys and crypto-shredded offboarding.

Every file is a threat.
Until it’s rebuilt.