Junction 2026 · Team #6

The last checkpoint before a confidential file leaves your company. AI reads the attachment, checks the recipient, and blocks the send.

Corporate data leaks rarely look like hacking. They look like an email — the wrong version of a spec, an internal pricing sheet CC'd to an external partner, a client list mailed to a personal address the week before someone resigns.

Existing DLP relies on static rules: filename patterns, keyword blocklists, manual labels. They break the moment a file is named final_v3.xlsx instead of CONFIDENTIAL_pricing.xlsx. ShhDoc reads what the file actually contains, resolves who the recipient actually is, and decides from there.

On attachment — AI classifies the file by its contents and assigns a security level. The verdict and its supporting evidence are cached in the background while the user is still writing the message.

On send — The recipient is resolved against the org directory (internal employee, verified partner domain, unknown external address). A policy matrix maps security level × recipient class to allow, warn, or reject. On rejection the sender sees exactly why: which file, which level, which policy.