Habits per mailbox

An email to christane@customer.com instead of christiane@customer.com goes to a stranger or to nobody. The domain is right, so the lookalike domain check does not notice. For that, MailGuard needs to know who the individual mailbox normally writes to. That is what MailGuard learns when you turn on Habits per mailbox.

With it, MailGuard detects in outbound mail:

• Mistyped recipients. The address is new to the mailbox but differs by only one character from an address it has written to several times.
• Sensitive content to a new domain. The message contains a card number, several bank accounts or documents about a person, such as a payslip or a medical letter, and goes to a domain your organisation has not written to before.

Invoices, quotes and contracts to new customers do not count as sensitive in this sense. They go out without a question.

Before you turn it on

MailGuard evaluates who writes to whom. This concerns your employees. Clarify first:

1. Co-determination. If there is a works council or staff council, it must agree. A technical facility that is suitable for recording employee behaviour is subject to co-determination in Germany.
2. Informing employees. Inform employees, for example in the privacy notice for employees. You will find a template below.
3. Threshold analysis. Check whether you need a data protection impact assessment. You will find a template below.

Conbool processes the data on your behalf as a processor. You remain the controller.

Turning it on

1. Open Settings → MailGuard, tab Sending.
2. In the Habits per mailbox card, turn on Learning.
3. In the dialog, confirm that co-determination has been clarified and employees have been informed, and click Turn on.

Conbool stores who confirmed and when. The card shows it below the switch.

A mailbox is checked only once MailGuard has known it for 14 days and at least 20 emails. Before that, there are no notices about mistyped recipients for that mailbox. Sensitive content to new domains is detected from the first day.

Levels

Under Possible misdirected email per mailbox you choose what happens on a match:

Start with Count only or Notify and switch to Ask the sender once the notices fit.

If the email goes out through the portal or as an encrypted PDF, MailGuard cannot hold it, because the invitation would be sent at once. At the Ask the sender level, MailGuard therefore rejects such a recipient. The sender gets a bounce with the reason and can correct the address.

What the sender sees

The notice names the recipient, the subject, the reason and the deadline. For a typo it shows the known address the sender normally writes to. The button opens a page with Send and Discard. Without a decision, the email for this recipient is discarded when the deadline passes, and the sender gets a notice. You set the deadline in the Protection when sending card.

Administrators see held emails on the quarantine page under Outbound, tab Check recipient, and can release or discard them there as well.

What MailGuard stores and what it does not

Per mailbox, MailGuard stores:

• contacts as check values (hashes with a secret key per tenant), not as addresses, with the number of emails per direction,
• check values of the spellings of these contacts, so that a typo can be detected without plain text,
• daily counters: number of emails and recipients, times by hour, kinds of attachments.

MailGuard does not store content, subjects or plain-text addresses. There is no page and no report that shows when or how much a person writes, or with whom. Administrators see individual incidents with their reason only.

On a Conbool Box, all data stays on the box.

Retention

Deletion runs daily.

Turning it off

Turn off Learning in the card. The per-mailbox check stops immediately, learned values are deleted after 7 days. If you turn it back on within these 7 days, MailGuard continues with what it has learned.

Template for informing employees

Adapt the text to your organisation and fill in the details in square brackets.

Protection against misdirected email

To protect against misdirected email, compromised accounts and fraud, our email service checks outgoing messages. For this, it learns which recipients each mailbox writes to.

Which data: times, volumes, kinds of attachments and circle of recipients per mailbox. Recipient addresses are stored only as an encrypted check value, not in plain text.

What not: content and subjects of messages are not used. Performance or behaviour of individual employees is not evaluated. There is no evaluation of who writes when, how much or with whom.

Who sees what: administrators see individual incidents with the reason only, for example "recipient possibly mistyped", no histories or profiles of a person.

What happens in an incident: [Depending on the level: the message goes out and administrators are informed / the message waits for the affected recipient until you decide via a link whether it goes out.]

Retention: daily counters after 42 days, contacts after 13 months without mail, everything 7 days after turning it off.

Legal basis: security of processing (Art. 32 GDPR), legitimate interest (Art. 6(1)(f) GDPR) [and national employee data protection law, works agreement of …, if any].

Your rights: you have the right of access, rectification, erasure, restriction and objection. Please contact [contact point, data protection officer of the company].

Service provider: the check is performed by Conbool GmbH as processor [for a Conbool Box: on our own server].

The text says "encrypted check value" because that is easier for employees to understand than "salted hash". It means the same.

Template: threshold analysis

As the controller, you decide whether a data protection impact assessment is needed. The template follows the nine criteria of the WP 248 guidelines of the data protection authorities. The Conbool assessment column describes the feature; you fill in Your organisation.

Result. Criteria 6 and 7 are met, criterion 3 partly. Under WP 248, two criteria together usually indicate an impact assessment. Against this stand the measures: check values instead of addresses, no content, no per-person view, short retention, purpose solely security. We recommend a short impact assessment if you protect more than [a number you set] mailboxes or have a works council. You can take the description of the processing, purpose, risks and measures from this page.