A verified pause, only when it matters
Outlatch sits between the Send button and your mail server. Most messages pass straight through. A small number are held, with a reason the sender can act on.
The check
When someone presses Send, the Outlatch add-in (Outlook) or extension (Gmail) builds a picture of the message in memory and compares it with that person's own sending history and your organisation's policy. It looks for twelve kinds of risk:
| Signal | What it catches |
|---|---|
| Lookalike domain | Swapped endings (.co for .com), look-alike characters, one or two letters different, a trusted name hidden inside another domain |
| Autocomplete slip | Same name as someone you write to, at a different address |
| Personal webmail | A business message headed to a consumer mailbox |
| Sensitive content | Health, personal, financial, legal or credential patterns leaving the organisation |
| Attachment mismatch | A file named for client A going to client B |
| Mixed organisations | Unrelated external organisations visible on one message |
| Reply-all widening | Reply-all that adds someone who was not on the thread |
| Bulk visible recipients | Many external addresses in To or Cc, where Bcc was meant |
| First-time domain or recipient | Someone you have never written to, or an organisation you have never written to |
| Last-second change | A new recipient added moments before sending |
| Blocked domain | Domains your organisation has said must never receive email |
Each signal has a weight your administrator can tune, and a simulator shows the effect of a change before it is saved.
The hold
Depending on the score, a message is allowed, allowed after the sender confirms the recipients, held, or blocked by a rule. A hold lasts a configurable number of seconds (15 by default, 45 when a signal is critical, up to five minutes). The sender sees why in plain language, for example "bob.smith@gmail.com has the same name as bob@globex.com, who you email regularly".
The second factor
After the cool-off the sender releases the message by proving it is them: a passkey, an authenticator code, an approval on their phone, or, for low-risk warnings, typing the flagged recipients back. The release is tied to that exact set of recipients. If someone changes a recipient afterwards, the check runs again.
What we store
The cloud service stores keyed hashes of recipient addresses, registrable domains, signal codes, scores, timestamps and the verification method, in a hash-chained audit log. It does not receive message bodies, subjects, attachment contents, display names or address books. More on security.
Where it runs today
| Platform | Status |
|---|---|
| Outlook (Windows, Mac, web) | In the pilot build, using Outlook's send-time add-in events |
| Outlook mobile | Coverage depends on Microsoft's mobile support for the add-in event; approvals work from our companion app |
| Gmail on the web | In the pilot build as a Chrome extension. Gmail offers no official send hook, so this approach can need updates when Gmail changes |
| Apple Mail | Planned |
| Gmail mobile and other clients | No send-time hook is available; planned server-side options with approval from the companion app |
Outlatch is in a pilot stage. This table describes what we have built and what we have not, not a general-availability commitment.