DLP using client configuration - prevent messages with some patterns from being sent unencrypted

[tomholub]

Google has its own mechanism for this https://cloud.google.com/dlp/ - you can configure it with various regexes and it may eg reject a message that the user is trying to send through standard gmail compose, across platforms.

FlowCrypt could also offer a list of regexes that customer can configure, passed through client configuration.

That way, the browser extension could inform the user that their email contains sensitive information, and prompt them to use encrypted email instead. This means the user will be informed as they are composing the message, not after.

Implementation-wise, it would be something like the following in client config:

  "prompt_switch_to_encrypted": [
    {"name": "Credit Card", "regex": ["\d{12-16}", "(\d\d\d\d\s?){4}"]}
  ]

The content script will then look for content of standard gmail compose, and scan it against these regexes. If there is a match, it would show a modal like The content of your message includes sensitive information: Credit Card. You should encrypt this message before sending. [Use encrypted message] [Continue composing].

The Use encrypted message would use existing functionality that copies the content from the compose window and opens new secure window and pastes it there. We currently use this for a similar prompt Your recipients use encryption: switch to encrypted message

[tomholub]

As an alternative approach, an important customer of ours uses labeling mechanism from Google Workspace to classify sensitive messages. And then they have particular labels that highlight that a message is sensitive. I don't know at which point the label is applied, whether it's during composing or only after it's sent, that would have to be tested. Here's an example of the settings:

[tomholub]

Here's what it looks like when composing a message - it will have a semicolon separated list of labels that I blacked out, which could be interpreted to look for the interesting labels and force user to use encrypted window instead:

[tomholub]

Similar when receiving email (unsure if this would need to be interpreted, I imagine the labels only matter to us when composing):