Clarity Secure

Your team is about to send something that isn't true.

Clarity Secure checks every outbound email and chat message against your organization's verified records — and stops the ones that contradict them, leak a registered secret, or carry instructions written for an AI rather than a person.

In the send path, not a report Fails safe by default Every decision auditable Per-user OAuth, no shared relay credential

The moment it earns its keep

"AWS GovCloud isn't supported." The approved press release says it is.

What was sent

To confirm: AWS GovCloud is not supported on our platform. GovCloud support is not available to customers and there is no date for it.

What happened — refused in the SMTP session. Nobody received it. The sender got this:

Your message was not sent. Nobody received it.

This message was stopped because it contains information that conflicts with
verified company records.

What to change:

  • Zaon has announced that its platform is now supported on AWS GovCloud (US).
    Source: AWS GovCloud Support Announcement
    Verified by dana@yourcompany.com on 2026-05-12
    → open the record

Correct the message and send it again — it will be checked the same way.

It doesn't just say no. It says what's true, who verified it, and links to the proof — because sometimes the record is the thing that's out of date, and the sender is the person best placed to notice.

The three things nothing else is checking

Email security was built for a human reader. Your reader is increasingly a machine.

Claims that contradict what you've verified

Your team answers from memory. Your company announced the opposite last month. Clarity Secure compares the outgoing claim against your verified corpus and stops the contradiction — then tells the sender what the record actually says, who verified it, and when.

Secrets you registered, not patterns someone guessed

Conventional DLP matches classes of data. Clarity Secure matches your secrets: the actual values, encrypted at rest, matched by fingerprint — plus credential-shaped strings nobody registered yet.

Instructions hidden for the machine

White-on-white text. Zero-width characters. An HTML part that says something different from the plain-text part. A reader sees nothing; an AI assistant sees an instruction. Clarity Secure reads what the machine reads.

Deployment

No migration. No new mail provider.

Clarity Secure fits the mail system you already have.

Gateway Point your mail client or MTA at a Clarity Secure submission endpoint. Each sender authenticates as themselves with OAuth — there is no shared relay password to leak. Available now
Platform mail Anything Zaon sends on your behalf is checked on the same path. Available now
Slack and Teams AI-generated answers are checked before they are posted. Available now

Built to be trusted, including when it breaks

A security control that hasn't planned for its own outage will be switched off during one.

Measured, in the send path — live gateway, ten concurrent senders

Median95th percentile99th percentile
2.6 s7.8 s16.0 s

Deterministic detectors

Deterministic detectors — credential shape, hidden-CSS concealment, multipart divergence — measure 100% precision and 100% recall against our test corpus, with zero false positives on benign mail as a hard requirement. A control that flags the weekly build notification gets disabled, and then it protects nothing.

Where the truth comes from

Clarity Secure enforces what Truth Curation™ in Zaon™ has verified.

The same verified record that answers a question inside your organization is the record that stops an outgoing email contradicting it. Facts carry a verifier and a date. Every fact you add makes both stronger.

And it refuses to overreach. Clarity Secure will only block on a contradiction when your workspace has declared that the attribute can hold one value at a time. "We ship from Rotterdam" and "we ship from Singapore" can both be true. "Supported" and "not supported" cannot. Where you haven't declared, it warns instead of refusing — and tells you which declaration would let it act.

See it stop a message that shouldn't go.

We'll run it against a claim you know is wrong and a secret you've registered, on your own wording, and show you the refusal and the correction the sender receives.

What it doesn't do

Prospects in security ask. Answering before they ask is worth more than the omission.

  • Microsoft 365 and Google Workspace mailbox connectors. Integration is via the submission gateway.
  • Retracting a message after delivery in Slack or Teams. AI answers are checked before posting; there is no post-delivery recall.
  • Scanning documents behind a SharePoint, OneDrive or Google Drive share link. Attachments are extracted and checked; a link to a file is not followed.
  • Relaying to a customer-specified mail host. Outbound relay goes via Amazon SES.