Method for data protection across sharing platforms

A method comprising:

• during a first time period:
• accessing a first corpus of messages sent from a first user account;
• correlating sequences of words, in messages of the first corpus of messages, with a first set of behavior signals;
• aggregating the first set of behavior signals into a first behavioral model representing combinations of behavior signals, in the first set of behavior signals, characteristic of behavior in messages sent from the first user account;
• in response to detecting a first number of messages in the first corpus of messages falling below a second threshold quantity:
• accessing a second corpus of messages sent from a group of user accounts, comprising the first user account, each user account in the group of user accounts exhibiting a particular identity characteristic;
• correlating sequences of words, in messages of the second corpus of messages, with a second set of behavior signals;
• and
• aggregating the second set of behavior signals into the first behavioral model representing combinations of behavior signals, in a combination of the first set of behavior signals and the second set of behavior signals, characteristic of behavior in messages sent from the group of user accounts;
• and
• associating the first behavioral model with the first user account;
• and
• during a second time period succeeding the first time period:
• accessing a first message outbound from the first user account to a first recipient account, the first message comprising a first document as an attachment to the first message;
• correlating sequences of words, in the first message, with a third set of behavior signals;
• accessing a first set of document tags associated with the first document;
• retrieving a first data access policy:
• associated with a first document tag in the first set of document tags;
• and
• comprising a first threshold at which access to a document associated with the first document tag is restricted;
• and
• in response to detecting a difference between the third set of behavioral signals and the first behavioral model exceeding the first threshold, restricting access, by the first recipient account, to the first document in the first message.

A method comprising:

• during a first time period:
• accessing a first corpus of messages sent from a first user account;
• correlating sequences of words, in messages of the first corpus of messages, with a first set of behavior signals;
• aggregating the first set of behavior signals into a first behavioral model representing combinations of behavior signals, in the first set of behavior signals, characteristic of behavior in messages sent from the first user account;
• associating the first behavioral model with the first user account;
• accessing a first subset of messages, of the first corpus of messages, sent from the first user account to the first recipient account;
• correlating sequences of words, in messages of the first subset of messages, with a second set of behavior signals;
• aggregating the second set of behavior signals into a second behavioral model representing combinations of behavior signals, in the second set of behavior signals, characteristic of behavior in messages sent from the first user account to the first recipient account;
• and
• associating the second behavioral model with the first user account;
• and
• during a second time period succeeding the first time period:
• accessing a first message outbound from the first user account to a first recipient account, the first message comprising a first document as an attachment to the first message;
• correlating sequences of words, in the first message, with a third set of behavior signals;
• accessing a first set of document tags associated with the first document;
• retrieving a first data access policy:
• associated with a first document tag in the first set of document tags;
• and
• comprising a first threshold at which access to a document associated with the first document tag is restricted;
• and
• in response to detecting a difference between the third set of behavioral signals and the first behavioral model exceeding the first threshold, and in response to detecting a difference between the third set of behavior signals and the second behavioral model exceeding the first threshold, restricting access, by the first recipient account, to the first document in the first message.