Book a demo

Itzal Mail

Looked at while the mail is still a draft

Outlook and Gmail, the message and the subject, the attachments and the recipient list, checked on the device when Send is pressed, while there is still time to change the mail.

Book a demo See pricing

  • 2mail clients covered
  • 4parts of a mail checked
  • 0mail routed through us

What you get

The attachment that went to the wrong address

The incident that actually happens in healthcare, legal and financial services is not a leak. It is a send.

  1. 01

    A check that knows who the mail is going to

    Recipients are read on the device and masked in the record. Inside the company and outside it get different actions, and the outside one wins when the list is mixed.

  2. 02

    The attachment checked, not just the message

    Subject, body, attachments and recipients. A clean covering note with a client file attached is still caught.

  3. 03

    Nothing in your mail flow to go wrong

    No connector, no relay, no gateway in front of your tenant. The check happens in the browser, on the device.

Where it works

Web mail, in the browser

Each service has its own switch and each is off until an admin turns it on, with the reason recorded in your audit log.

  • Mail services

    Outlook, through an add-in that runs in the client, and Gmail in the browser. Each is checked when Send is pressed, or while the mail is being written at the deeper setting.

  • What is checked

    The text and subject, the attachments, and who it is addressed to, including Bcc, which counts like any other recipient.

  • Browsers

    The same extension Guard uses, pushed by browser policy through your MDM.

Frameworks

Every framework brings its own thresholds and its own action

A finding is not just a kind of data, it is a kind of data under an obligation. Each framework carries its own thresholds and its own action, which is what lets one laptop block for HIPAA and only warn for Internal.

  • HIPAA

    Health records

    Patient names, record numbers and clinical detail, under the identifiers the rule lists.

  • PCI DSS

    Card data

    Card numbers validated by Luhn and BIN, so a test number next to the word example does not fire.

  • GDPR

    EU personal data

    Names, addresses, identifiers and the context that makes them a record rather than a mention.

  • CCPA

    California residents

    The same personal data, under the obligations that apply in California.

  • GLBA

    Customer financials

    Account and routing numbers, balances, and the material non-public information around them.

  • FERPA

    Education records

    Student records and anything that identifies a student inside them.

  • SOX

    Financial reporting

    Unreleased results, forecasts and the working papers behind them.

  • Internal

    Your own rules

    Your patterns and your own kinds of thing, in your words: project codename, claim handler, deal name.

Plans

How it is sold across the editions

Mail is included in the two platform editions and sold as an add-on on the Guard editions. Outlook and Gmail are checked while the message is still a draft, on the same agent that is already installed.

  • Guard Essentials Add-on

    Available on its own, priced per device like the edition.

  • Guard Pro Add-on

    Available on its own, priced per device like the edition.

  • Itzal Business Included

    Outlook and Gmail, checked before the message is sent.

  • Itzal Enterprise Included

    As Itzal Business, with dedicated tenancy and longer retention.

See the full comparison and prices

What it catches

The send you would want back

Three mails that go out of an ordinary office every week.

  1. Healthcare

    A discharge summary is attached to a mail going to an outside address.

    Attachments are checked, the recipient is read as outside the company, and the outside action applies, which can be block where the inside one is only a warning.

  2. Legal

    A matter note is pasted into a mail to the wrong client in the address book.

    The body is checked at the moment of the send, and the recipient is part of the decision rather than an afterthought.

  3. Finance

    A reply-all adds somebody outside the firm to a long thread nobody scrolled to the bottom of.

    The quoted thread underneath is text in the message, so it is checked like the rest of it.

When it finds something

You choose what happens next

Three settings, chosen per compliance framework rather than per person, so HIPAA can block on the same laptop where Internal only warns. Most companies spend the first couple of months on the first one.

  1. Quietest

    Make a note of it

    Nobody is interrupted. You get a picture of what is happening before you change anything about how people work.

  2. In the middle

    Tell the person

    A banner before the send, saying what was spotted. They decide, and the decision is recorded.

  3. Firmest

    Stop it going

    Held until the data is taken out. Only where you have decided it is worth it, so the rule does not push people somewhere worse.

Set it to watch for a month, then decide. That is how almost everyone starts.

Book a demo How the rollout works

What Mail does not do

The limits, said plainly

Every product on this site has a boundary. Ours are worth knowing before you buy rather than after, and the console reports them the same way.

It does not read your mailbox.

Only the mail being sent, as it is sent. Never the inbox, other folders, contacts, the calendar or any other account.

It does not cover mail sent from a phone.

Outlook and Gmail on a laptop you manage. Mail sent from a personal phone is outside a device-based control.

It does not hold mail for review.

There is no quarantine and no approval queue. The warning goes to the person writing it, while they can still do something about it.

Questions

What people ask before they book

Short answers. The longer versions are in the pages linked from each one.

Does our mail route through Itzal?

No. There is no connector in your mail flow, no relay and no gateway in front of your tenant. The check runs in the browser on the device, so there is nothing of ours to fail in the send path.

What counts as outside the company?

The verified domains you list under Settings. Anything else is outside, and when a mail has recipients both inside and outside, the outside setting is the one used.

Are recipient addresses stored?

They are read on the device to make the decision and masked in the record that leaves it. The same applies to the signed-in account, which is read only to tell a work account from a personal one.

Does it check while someone is writing, or only on send?

On send by default: text, subject, attachments and recipients. There is a deeper setting that also checks the mail while it is being written, and turning it on asks you to confirm staff were told.

Does it work in the Outlook client or only the browser?

Both. Outlook is covered by an add-in that runs inside the client, and Gmail is covered by the same browser extension Guard uses.

The rest of the family

Everything else is a licence, not another rollout

Healthcare, legal and financial services, where the attachment going to the wrong address is the incident that actually happens.

See Mail on your own laptops.

Built for the people who email client data. Half an hour, your hardware, and a straight answer on what it would cost.

Book a demo See pricing