The safest copy of your email is the one we never receive
Outlatch is designed so that compliance and security teams have less to assess, not more.
Data boundary
| Stays on the sender's device | Reaches the Outlatch service |
|---|---|
| Message body and subject Attachment contents and names Display names and the address book Plain recipient addresses |
Keyed hashes of recipient addresses Registrable domains (organisation level) Signal codes, score, timestamps Verification method, device and user identity |
Recipient hashes use a per-organisation key derived from a secret that lives in Cloudflare, so a leaked hash is not reversible with a dictionary of email addresses alone.
Controls
Authenticated release
A held message is released only after a passkey, authenticator code or phone approval, after a cool-off the server enforces. Approvals are bound to the recipient set and expire.
Tamper-evident audit
Every hold, release and administrative change is written to an append-only, hash-chained log. Daily anchors are stored separately, and a command-line tool verifies the chain offline.
Tenant isolation
Every record carries its organisation, every query is scoped to it, and each organisation has its own hashing key.
Admin access
The admin console sits behind Cloudflare Access with your identity provider's multi-factor sign-in. All administrative writes are attributed and audited.
Least data, short retention
Retention is set per organisation, with a default aligned to six-year health-record programmes. Website visitors' network identifiers are hashed and deleted after 30 days.
Hosted on Cloudflare
The service runs on Cloudflare Workers, Durable Objects, D1 and R2 in one account. We do not use other cloud providers in the request path.
Compliance posture
Outlatch is designed to support organisations that must meet HIPAA, SOX and GDPR obligations. We do not claim certification we do not hold.
| Framework | How the design helps | Status |
|---|---|---|
| HIPAA | Message content, where PHI usually lives, is never transmitted. Access control, audit controls, authentication and integrity are built in. | Business associate agreement planned with the HIPAA pack, once our own agreement with Cloudflare is in place |
| SOX | Attributable releases, change-controlled policy and an audit trail auditors can sample and verify. | Control mapping prepared; SIEM export on the roadmap |
| GDPR and UK GDPR | Data minimisation by construction, which also supports the proportionality case in a monitoring impact assessment. | Data processing agreement available to pilot partners; EU region option planned |
| SOC 2 Type II, ISO 27001 | Controls are being built to the same criteria. | Planned, not yet audited |
Report a vulnerability
Email security@outlatch.com with reproduction steps. We acknowledge reports within two business days. Please do not publish details until we have had a reasonable chance to fix the issue. Our security.txt has the details.
Security questionnaires
Pilot partners receive our architecture, threat model and control mapping. Ask at hello@outlatch.com.