Outlatch
Now onboarding pilot partners

Stop the email that
should not leave.

Outlatch holds a risky send, tells the sender exactly why, and releases it only after a second factor. The check runs on the sender's own device, so message content never reaches us.

Join the waitlistSee how it works
  • Outlook and Gmail first
  • Metadata-only cloud
  • Built on Cloudflare
  • Designed to support HIPAA, SOX and GDPR programmes

Misdirected email is a leading breach type, and a banner does not stop it

18.3%

of the 13,457 personal data breaches reported to the UK ICO in 2025 were email sent to the wrong recipient: 2,459 reports, up 62% since 2020.1

£350,000

fine for the UK Ministry of Defence in December 2023 after emails to Afghan applicants were addressed in the To field instead of Bcc.2

70%

of Chrome security warnings were clicked through in a field study of about 25 million warnings. People learn to dismiss prompts they see every day.3

Figures are reports to a regulator and a browser study, not a measurement of any email product. Sources and caveats.

Four mistakes, one safeguard

The autocomplete slip

You meant bob@globex.com; Outlook picked bob.smith@gmail.com. Outlatch notices the name matches someone you write to, at a different address.

The lookalike domain

globex.co is not globex.com. Outlatch compares every domain with the ones you already trust, including swapped endings and look-alike characters.

Two clients on one thread

Client A's pricing sent to client B, or a reply-all that adds someone who was never on the thread. Outlatch sees the mix before it is sent.

Regulated data going outside

Patient identifiers, account numbers or credentials in a message headed to a personal address or a new organisation are held for a second look.

How it works

A small, deliberate pause at the moment of highest risk. Most sends pass straight through.

How an Outlatch hold works The sender presses Send. The check runs on the sender's device. A risky message is held with plain-language reasons. After the cool-off the sender verifies with a second factor and the message is released. Message content stays on the device. 1. SendYou press Sendin Outlook or Gmail 2. Check on device12 signals: lookalikedomains, slips, mixed clients,regulated data 3. Hold15 s cool-off (configurable)with plain reasons 4. VerifySecond factor, then sent Message bodies, subjects and plain recipient addresses never leave your device.

Read the details

Private by design

Checks run locally

The risk engine runs inside the Outlook add-in or Gmail extension. Bodies, subjects and attachments are read there and discarded.

Hashed recipients only

Our service sees keyed hashes of addresses, domains, signal codes and scores. It cannot show an administrator what an email said.

Tamper-evident audit

Every hold and release is written to a hash-chained log that an auditor can verify independently.

Security and compliance posture

Simple, published pricing

Indicative launch pricing: free for up to three people, from $4 per user per month for teams, with compliance packs for HIPAA, SOX and GDPR.

See pricing

Get early access

We are working with a small number of design partners in healthcare, legal and finance. Tell us about your organisation and we will be in touch when places open.

Join the waitlist