Outlatch
Why Outlatch exists

Everyone sends the wrong email eventually

An autocomplete picks the wrong Sam. A reply-all pulls a client into an internal thread. A domain differs by one letter. The mistake takes a second; the consequences can take years.

The problem is old, and still growing

In the UK, email sent to an incorrect recipient was the single most reported type of personal data breach to the Information Commissioner's Office in 2025: 2,459 reports, 18.3% of the total, and up 62% from 2020.1 Regulators have started to say plainly that training and policy are not enough for sensitive email. The ICO's 2024 guidance tells organisations to stop relying on Bcc for sensitive bulk email,4 and Denmark's data protection authority requires technical measures as well as organisational ones.5

The consequences are not abstract. The UK Ministry of Defence was fined £350,000 in December 2023 after an addressing error exposed Afghan applicants.2 In healthcare, a single misdirected message can be a reportable breach and a breach of patient trust.

Why existing controls do not fix it

  • Banners and pop-ups. A warning that appears on every external email trains people to click through. In a field study of 25 million browser warnings, 70.2% were dismissed.3 Nobody has published an equivalent figure for email banners, which is one of the things our pilots will measure.
  • Training. Necessary, and not sufficient. The mistake happens when someone is moving fast and is confident they are right.
  • Gateways and behavioural suites. Strong products, but usually priced and packaged for large enterprises, and many ingest message content into their own cloud, which healthcare and legal buyers often cannot accept.
  • Platform controls. Useful building blocks. They warn or block by rule; they do not ask the sender to authenticate before an unusual message is released.

What we think should happen instead

  1. Judge the send, not the inbox. Compare the recipients with who this sender really writes to, not with a generic list.
  2. Interrupt only when it matters. A short, specific hold, with the reason in plain words, beats a generic warning on every message.
  3. Make release a deliberate act. A second factor turns "the user clicked OK" into "the user proved it was them, on purpose". That is also an attributable event an auditor can sample.
  4. Keep the content at home. If the check runs on the device, there is no copy of your messages in someone else's cloud to protect, disclose or breach.

That is Outlatch: a verified pause at the moment of sending, with a privacy model simple enough for a compliance officer to explain in one sentence.

Join the waitlist How it works

Sources and caveats

  1. UK Information Commissioner's Office data security incident reports for 2025, as analysed by Servnet (servnetuk.com, September 2026). These are reports made to the regulator, not a count of all incidents.
  2. ICO enforcement notice and penalty against the Ministry of Defence, 13 December 2023. The fine was reduced under the ICO's public sector approach; private organisations should not assume a similar reduction.
  3. Akhawe and Felt, "Alice in Warningland", USENIX Security 2013: 70.2% click-through on Chrome SSL warnings across about 25 million warning impressions. A browser study, not an email study.
  4. ICO statement on bulk email and Bcc, 30 April 2024.
  5. Datatilsynet (Denmark) guidance on misdirected email, in effect from 1 March 2024. Applies to Denmark.

We will replace third-party figures with measurements from our own pilots as they become available.