Stop Outbound Email Leaks in Microsoft Outlook Before Send
Misdirected autocomplete recipients and unredacted attachments remain one of the fastest ways sensitive records leave an organization. PrivacyScrubber ZTDS™ Guard inspects outbound Outlook drafts, recipient domains, and attachments 100% inside local client RAM (<15ms), enforces ISO/IEC 27001:2022 Annex A.5.12 & A.8.11 safeguards, and replaces PII with reversible tokens ([NAME_1], [ID_1], [IBAN_1]) on any Microsoft 365 Business or Enterprise plan.
See Pre-Send Catch, Tokenization & Recipient Reveal in Action
Please find the updated referral for Sarah Jenkins (NHS 485 777 3456) along with settlement payout to IBAN GB29 NWBK 6016 1331 9268 19 before Friday.
Regards, Legal Operations
partner-firm.co.uk. Please find the updated referral for
[NAME_1] (NHS [UK_NHS_1]) along with settlement payout to IBAN [IBAN_1] before Friday.Regards, Legal Operations
[Corporate Banner Signature & Formatting Kept Intact]
Fonts, tables, inline replies, and company legal signatures remain untouched. Text replacements only substitute identified PII spans and generate a reversible ZTDS™ card cleanly inside Classic Win32, New Outlook, Mac, and OWA.
- Optional AES-256-GCM / XChaCha20-Poly1305 encrypted handoff block
- Survives Microsoft Defender SafeLinks URL wrapping automatically
- Instant local sender undo while composing
Protected ZTDS™ Message Detected
External recipients do not need accounts, portals, or installations. Enter the out-of-band passphrase in any browser to restore original values strictly inside local RAM.
Councils, opposing law firms, patients, and vendors read protected emails in 2 seconds without remembering temporary Microsoft guest passwords or installing extensions.
Choose Your Pre-Configured Manifest (.XML)
Both manifests run 100% locally in client RAM. Choose Strict Block for organization-wide M365 Admin Center enforcement or Pilot Mode for rapid team evaluation.
Hard Pre-Send Block · M365 Admin Center & Intune Rollout (Zero Unzip)
Interactive Soft-Block · Direct upload at aka.ms/olksideload
Need offline archive bundles with icons included? Download Enterprise .ZIP or Pilot .ZIP.
Generate Pre-Configured Company manifest.xml (Zero Employee Setup)
Deploying to 10 or 5,000 seats? Pre-embed your corporate TEAMS or PRO license key, default industry sector, and perimeter policy inside a single custom .xml file generated 100% locally in your browser RAM (zero bytes transmitted to servers). Every assigned employee opens Outlook pre-activated on Day 1 without typing a license key.
Compiled 100% client-side using URL fragment isolation — license keys never transit HTTP logs.
Smart Perimeter Awareness
Automatically compares To, CC, and BCC domains against the sender's corporate domain so internal collaboration stays friction-free.
Signature-Safe Tokenization
Surgically replaces sensitive text spans inside compose drafts while preserving corporate signatures, inline replies, fonts, and Win32 HTML layout.
4-Client Universal Parity
Single XML deployment covers Classic Outlook for Windows (Win32), New Outlook Windows, Outlook for Mac, and Outlook on the Web (OWA).
Zero-Portal Recipient Reveal
External counsel, clinics, or clients restore protected fields locally in browser RAM in 2 seconds with zero encrypted portal logins.
Architecture & Cost Comparison: ZTDS™ Outlook Guard vs. M365 E5 & Cloud Gateways
| Capability | PrivacyScrubber Outlook Guard (ZTDS™) | M365 Purview DLP | Legacy COM / Cloud Gateways |
|---|---|---|---|
| Inspection Boundary | 100% Client RAM before SMTP dispatch (0.00 Bytes server egress) | Exchange cloud transport post-send evaluation | Third-party cloud relay or Windows-only DLL |
| Reversible In-Draft Tokenization | 1-Click deterministic surrogates ([NAME_1], [ID_1]) + signature preservation | Full-message portal encryption or block only | Recipient warning checkbox only |
| Fleet Cost Model | $99/mo flat TEAMS for unlimited seats on M365 Business Basic / Standard | Requires M365 E5 upgrade or Purview per-seat add-ons | $36–$180 per user/year + minimum seat commits |
| Statutory Due Diligence Evidence | Tamper-evident SHA-256 receipt mapped to ISO 27001 Annex A.5.12 & GDPR Art. 32 | Cloud compliance portal logs | Vendor-hosted telemetry database |
60-Second Zero-Touch M365 Admin Center & MSP Rollout
- Copy URL or Generate Tenant XML: Click Copy Direct XML URL above for an instant baseline, or use the Zero-Touch Configurator to download a pre-licensed company
.xmlwith your sector profile pre-activated. - Deploy in Microsoft 365 Admin Center: Navigate to
Settings -> Integrated apps -> Upload custom apps, select Office Add-in, and paste the direct XML link (or upload your generated company.xmlfile — zero unzipping needed). - Scope Security Groups: Assign to your entire organization or high-exposure units (Legal, Finance, HR, Clinical, Executive). Every employee wakes up protected with zero manual key entry.
- Unified Key Governance: One PrivacyScrubber TEAMS license key unlocks both the Microsoft Outlook Add-in and the Browser AI Shield across ChatGPT, Copilot, Claude, and Gemini.
Protect Your Entire Microsoft 365 Organization for $99/mo Flat
One flat TEAMS key covers unlimited employees across Outlook Pre-Send Guard, Chrome Extension AI Shield, WordPress Forms, and Teams Encrypted Handoff — or start with an individual PRO ($15/mo) license.
Frequently Asked Questions
Does the Outlook Add-in send email bodies or attachments to PrivacyScrubber servers?
No. All pre-send Smart Alert inspections, entity detection across 30 industry profiles, in-draft surrogate tokenization, and inbound read-pane reveals execute strictly inside the local Outlook client memory. Zero bytes of message text, recipient addresses, or attachments ever transit to our infrastructure.
How does Smart Perimeter Mode prevent alert fatigue on internal colleague emails?
By default, Smart Perimeter Mode compares every recipient in To, CC, and BCC against the sender's own corporate email domain. Routine internal emails within the same organization proceed without friction, whereas any message containing at least one external recipient triggers full pre-send PII and attachment verification. Security teams requiring internal compartmentation can switch to Strict Zero-Trust Mode in one click.
Will in-draft protection break corporate HTML signatures or font formatting?
No. Protection applies targeted text-span substitutions inside your draft while preserving corporate legal signatures, inline replies, logos, and formatting cleanly across Classic Windows Outlook, New Outlook, Mac, and OWA.
What happens when large PDF or Office attachments are added to an external email?
To guarantee sub-second responsiveness well inside Outlook's 5-second pre-send window, lightweight text attachments (up to 512 KB, including CSV, JSON, TXT, XML, and logs) are scanned automatically in memory, while binary PDF and Office documents addressed to external recipients trigger an explicit verification checkpoint unless reviewed or pre-sanitized in the workspace.
Can Managed Service Providers (MSPs) deploy this across multiple SME Microsoft 365 tenants?
Yes. MSPs roll out the XML manifest via Microsoft 365 Integrated Apps or Microsoft Graph Partner APIs in under 90 seconds per tenant without needing Microsoft 365 E5 licenses, providing technical statutory risk minimization aligned with GDPR Art. 32 and ISO/IEC 27001:2022 Annex A.5.12 & A.8.11.
