How to Stop Sending Sensitive Data by Email: DLP, Keyword Scans and Checks at Send

What counts as sensitive

The things that most often leave by accident:

• card numbers and bank details
• social security numbers and other ID numbers
• passwords, API keys and access tokens
• client names, project code names and deal terms
• health and HR information

The tools that catch these are called DLP, short for data loss prevention. They differ in one way that matters more than any feature list: when they check, and who finds out.

Option 1: Rules on the mail server

Both big business email systems let an admin set rules that run on outgoing mail after you click Send.

• Microsoft 365: Exchange mail flow rules (also called transport rules) match words, phrases or patterns and can reject the email, send it for approval, or add a notice. They are in the Exchange admin center on every business plan.
• Google Workspace: content compliance rules in the Admin console, under Apps, Google Workspace, Gmail, Compliance, do the same for Gmail.

Good for: a hard company-wide line, such as "nothing with this project code name leaves the domain".

Where it falls short: the sender finds out from a bounce, or not at all if the email is quarantined. They never get the chance to just remove the number and send again.

Option 2: Built-in DLP with a warning in the compose window

The more advanced versions come with ready-made detectors for card numbers, ID numbers and similar, and can warn the person while they are still writing.

• Microsoft Purview DLP shows a policy tip in Outlook when an email matches a rule, and can block it or let the sender override with a reason. It comes with Microsoft 365 Business Premium and the E3 and E5 plans, not with Business Basic or Business Standard.
• Google Workspace DLP for Gmail can warn the sender with Back to editing or Send anyway. It comes with the Enterprise, Frontline and Education editions, not with the Business plans. Details are in our Gmail DLP guide.

Where it falls short: it needs an admin and the right plan, which most small companies do not have. And it is built around the security team's list, not the mistakes your team actually makes. Nobody writes a DLP policy for "we keep sending the draft price list to the wrong client".

Option 3: An add-in that scans at Send

VIPRE SafeSend, the Outlook add-in, includes a keyword and pattern scan. IT sets the list, and SafeSend checks the email and its attachments for it when you click Send, in the same window that confirms outside recipients. It is Outlook only and deployed by IT. We cover it in What is VIPRE SafeSend?

Option 4: A check in the browser, for anyone

Presend is a Chrome extension that checks the email in the compose window when you click Send, in Gmail, Outlook on the web and other places you write in the browser. Nobody in IT has to set it up, and it works on any plan, including personal Gmail.

Its built-in checks for sensitive content:

• Leaked API key / token. Known key formats, plus anything the sentence itself calls a password or key ("the password is ..."), even when the value has no known format. On Block by default.
• Sensitive number (SSN / card). Numbers shaped like card numbers or social security numbers. On Block by default.
• Banned phrases. A list you set, such as a project code name or "internal only".
• Your own rules, in plain English or as a pattern: "Block any email to an outside address that mentions salary".

When one blocks, Send stops with "Hold on" and the reason. You choose Review message or Send anyway. Presend checks the text of the email. It does not open attachments.

Which to use

They work best together:

The server is the net. The check at Send is where people actually fix their mistakes, because they see them while they can still change the email. For why passwords end up in email in the first place, see pre-send checks for attachments, recipients and leaks.