Features
Human Confirmed binds mailbox identity, live presence, the readable body, and the recipients into a signed attestation. Mail clients stay thin. Face capture stays on the sender’s phone.
What is checked
| Bound | Meaning |
|---|---|
| Who | A live face check on the phone, matched to the mailbox holder enrolled for this product. |
| What | A fingerprint of the readable body, plus a stable verify-site line that is part of that fingerprint. The whole MIME file is not hashed, because received mail changes in transit. |
| To whom | A fingerprint of To and Cc taken at the face check. A later change is reported as a recipient change, not a green result. |
Quoted replies, the logo, and the Click to Verify link are left out of the body fingerprint so ordinary mail-client rewriting does not break an honest copy.
Outlook and Gmail
IT deploys the Outlook add-in. People do not install a desktop app. Gmail is a Workspace add-on. Both start the same phone check.
| Where | Send with the check | Check a received copy |
|---|---|---|
| Outlook on the web, new Outlook, classic Outlook on Windows, Outlook for Mac | Yes | Yes, in the read pane |
| Outlook on iPhone and Android | Send interception is not available | Use Click to Verify on the stamp |
| Gmail | Yes, from the compose action | Yes, in the side panel |
You do not have to confirm every message. If an organization turns on keyword prompts, Outlook may pause Send on drafts that look high-value. The sender can still send without confirming.
Someone without the add-in opens Click to Verify, or saves the message as .eml and drops it on the verify page. The face still appears only if the body matches what was confirmed.
How to read a result
| What you see | What to do |
|---|---|
| Human Confirmed, body matches, face shown | This copy is the text that was face-checked, for this mailbox holder. |
| Body does not match | Do not trust payment or account details in this copy. Contact the sender on a known channel. |
| Recipients changed after verification | Treat it as a stop-the-wire signal until proven otherwise. |
| Stamp present, check failed or unavailable | The logo is not proof. Only a successful check of this copy is. |
The face stays gated
The sender’s face appears only when the checker holds a matching copy of the body. A leaked verify link by itself does not show the face. The successful verification JPEG is encrypted and stored only for the attestation lifetime. Enrollment photographs are not retained. The image is not proof by itself; proof is the signed attestation plus a matching copy of the message.
What we do not claim
- We do not replace DKIM, DMARC, or S/MIME.
- We do not block unverified mail. Organization-wide hold rules are a mail-flow decision, separate from this check.
- We do not hash attachment content. Recipients re-check the readable body and To/Cc.
- A custom mail header by itself is not proof. The read path re-hashes the copy in hand.