Guardcell · James Dimachkie

SC 01

Overview

Email leaves companies carrying things that were meant to stay inside: a password, a margin, a remark about a client, a spreadsheet of people’s details. Guardcell checks supported outgoing emails when you press Send in Outlook. If it finds a possible disclosure, it says what it found and asks whether you’re sure.

SC 02

The problem

Rules can identify recognizable patterns like card numbers, but sensitive business details can appear in many different wordings, and the check can’t send the email to a server to read it. An add-in that interrupts Send also lives or dies on two numbers: how many disclosures it catches, and how many ordinary emails it questions for nothing.

Guardcell in Outlook. A dialog titled "Message from Add-in: Guardcell" says the email goes outside the company and includes your margin and your negotiating position, lists "Greets Kate, sent to dan@whitfielddev.example", and offers Send anyway, Review and Don't send. Beside it, the Review pane shows the outside recipient and two findings: the greeting doesn't match the recipient, and a sentence revealing the margin, with a button to remove it.

SC 03

What I did

I designed the product and made the ship decisions against bars fixed in advance; teams of AI agents across model families wrote the code, the training data and the test sets. Everything runs on the sender’s computer, with no server, account or telemetry: recipient checks, its own readers for DOCX, XLSX, PPTX, PDF and CSV attachments, on-device text recognition, rules for anything with a checkable shape and, on supported clients, a 17-million-parameter sentence model, 17 MB once quantized. The model gets up to 2.5 seconds of the add-in’s 4.5-second send deadline and keeps partial results if time runs out. A file it can’t read counts as a finding, never as a pass.

Guardcell's setup page, headed "Check before it leaves. Checks run inside Outlook on each sender's device. Nothing in the email is sent anywhere to be checked." The form to make a manifest is set to Ask when it finds something, Ask when it can't check, and the on-device model On.

SC 04

How I tested it

I committed pass bars and candidates before scoring fresh, separately written test sets, and later plans say where earlier test data was reused. The fresh sets were written by AI models, from two companies, that wrote none of the training data. Four of the nine gates failed and a fifth candidate never reached its test; the failures are published with the passes. On the hardest synthetic check, Guardcell with the shipped model caught 101 of 120 disclosures and questioned 9 of 398 ordinary emails; rules and recipient checks alone caught 15.

SC 05

The tradeoff

Synthetic mail wasn’t enough, so I tested on real mail: 2,000 held-out emails from the public Enron corpus. Claude models labeled every email any system had asked about, plus 300 of the rest, without knowing which system had asked. Guardcell asked about 35% of the emails, and 28% of all emails were judged needless asks, but it caught 61 serious disclosures to the rules’ 19.Guardcell evaluation, “Real mail, and gate 6”: 2,000 outside emails from the public CMU Enron corpus, held out from development. Claude models labeled every email any system asked about, plus 300 others, blind to which system asked. A quieter v2.4 candidate asked 8.4% and caught 37, so it failed its gate; a fresh 2,000-email sample at gate 9 replicated the shipped model’s result. Annotated corpus results, not live rates.Source A calmer candidate asked a quarter as often and caught 24 fewer, so I rejected it. A later attempt asked 43% less on a fresh sample but missed six serious disclosures, and failed too. An extra click costs far less than a leaked margin, so Guardcell stays recall-first, and the repository says so.

SC 06

The result

Released as open source under Apache 2.0 on 25 October 2026. I had agents rebuild 49 documented email incidents, from regulator notices, court records and major reporting, as test emails with invented names, and used them to sharpen the checks. Of the 43 addressed outside the company, the current build asks about 35. Those incidents shaped the checks, so that is a development result; it doesn’t show the originals would have been stopped. 1,586 files built to break parsers, from the pdf.js and Apache POI test collections, ran without a crash or hang.Guardcell evaluation, “Attachments”: files from Mozilla’s pdf.js and Apache POI test collections, each in a bounded process. Partial reads come back as can’t-check, which asks. Measures parser robustness, not detection accuracy.Source Phone sends, some protected items and other paths are not covered, and classic Outlook uses rules only; the repository lists every limit.