What does email DLP check in a mail?

It checks the subject, the body and the text inside attachments. It looks for fixed patterns such as an IBAN or a card number, for keywords and for custom patterns that you define.

Does DLP block everything that looks suspicious right away?

No. For each rule you choose: monitor only, quarantine or reject. Many companies start in monitor mode. That way they first see what the rules would catch.

How does the gateway avoid false alarms on numbers?

It also checks card numbers and IBANs with their checksum. A random string of digits does not trigger a match. Some patterns have extra filters, for example against dates.

Is recipient checking active right away?

No. It is off by default and then starts in monitor mode. Even in hold mode it only holds mail once it has learned enough about your usual contacts.

Mail Security Gateway

Data loss prevention

Keep confidential data in house with DLP for outbound mail

A customer list with bank details, sent to the wrong address by mistake. Or an access key in an attachment. Such slips happen fast. The data loss prevention (DLP) in the Mail Security Gateway spots them before the mail leaves your company.

Request a demo

What email DLP detects

A data leak often happens without any attacker. Someone simply sends the wrong file. So the gateway checks every outbound mail from your users. It reads the subject, the body and the text inside attachments.

Ready-made patterns

The gateway comes with a pattern library for common cases. You do not have to write search rules yourself. It covers:

IBANs and card numbers, each checked with its checksum
the German tax ID and German ID card numbers
private keys and access keys for cloud services and developer platforms
long, random-looking strings that are typical of passwords and secrets

Your own keywords and patterns

You can add your own lists, such as project names or "strictly confidential". Upper and lower case do not matter. For special cases you add your own patterns, for example for your customer numbers. A rule can wait for a minimum number of hits. A single IBAN on an invoice then triggers nothing, but a list of a hundred does.

Monitor, quarantine or reject

For each rule you decide what happens on a match:

Monitor: The mail goes out. The match is logged.
Quarantine: The mail is held. An admin checks it and releases or deletes it.
Reject: The mail is not sent.

Each pattern has a default. Private keys, for example, are rejected. You can change that default in your rules. If several rules match, the one with the highest priority wins. Every match is recorded. So you can see later which rule fired and when.

An example: accounts sends a sheet with many IBANs to a private address. The rule for bank details fires. The mail goes to quarantine, and an admin takes a look. If it was a mistake, the mail is deleted. If all is fine, the admin releases it. This protects personal data and helps you meet your GDPR duties.

More control when sending

Signature and disclaimer

The gateway adds a centrally managed signature or legal notice to outbound mail. You set the rules per tenant. The gateway fills placeholders such as name or phone number for each sender. You can leave out replies and purely internal mail. Signed mail stays unchanged. The feature is off by default.

Recipient checks against misdirected mail

One click in the address suggestions is enough, and the mail goes to "m.smith" instead of "n.smith". Recipient checking spots such mix-ups. It also finds typos in domains such as "gmial.com". To do this, it learns who usually writes to whom. If the risk is high, it holds the mail. The sender then gets two signed links: send or discard.

In grey areas a language model can help. It only sees the subject, sender, recipients and statistics, never the mail body. Recipient checking is off by default and starts in monitor mode. It always holds the whole mail, not single recipients.

Questions about email DLP

What does email DLP check in a mail?: It checks the subject, the body and the text inside attachments. It looks for fixed patterns such as an IBAN or a card number, for keywords and for custom patterns that you define.
Does DLP block everything that looks suspicious right away?: No. For each rule you choose: monitor only, quarantine or reject. Many companies start in monitor mode. That way they first see what the rules would catch.
How does the gateway avoid false alarms on numbers?: It also checks card numbers and IBANs with their checksum. A random string of digits does not trigger a match. Some patterns have extra filters, for example against dates.
Is recipient checking active right away?: No. It is off by default and then starts in monitor mode. Even in hold mode it only holds mail once it has learned enough about your usual contacts.

Set up DLP rules together

We show you the pattern library and plan a start in monitor mode with you.

Request a demo

How we work with you

We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.

1. Free initial conversation

We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.

2. Current state review

We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.

3. Delivery with a dedicated lead

An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.

4. Running and reviewing

After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.