EMAIL SECURITY QUESTIONS, ANSWEREDQuestions should have clear answers.

Identity, authentication, intent, social-engineering behaviour, links, supported attachments, routing evidence and campaign context are combined into one explainable assessment.

Jatzo combines more than one hundred explainable checks across sender identity, From/Reply-To/Return-Path relationships, SPF/DKIM/DMARC evidence, source routing, message intent, social-engineering behaviour, impersonation, link structure, attachments and campaign context. Signals are grouped and deduplicated so repeated evidence does not simply inflate the score. A pass written in an uploaded email header is not independently verified by Jatzo. It is not proof of who sent the message and does not cancel independent warning signs.

Verified brand-domain families, a broad identity watchlist and generic organisation checks are combined with lookalike domains, Unicode/confusable characters, suspicious subdomains, machine-like sender infrastructure and identity-coherence checks. The engine asks whether the displayed identity, sender address, Reply-To, Return-Path, sending domain and destinations make sense together. A watchlist match or unusual domain alone is supporting context, not automatic proof of phishing.

Eligible plans can inspect destination-domain evidence and statically profile attachments without executing them. Jatzo checks file signatures and extension mismatches, archives, Office macro indicators, external relationships, active PDF features, HTML smuggling markers, nested emails and URLs exposed inside supported files. Personal and above add live link reputation, from Google Web Risk, and further infrastructure context. Google works to provide the most accurate and up-to-date information about unsafe web resources. However, Google cannot guarantee that its information is comprehensive and error-free: some risky sites may not be identified, and some safe sites may be identified in error.

HTTP does not encrypt the connection if used as written. This is a separate warning from the phishing score. Avoid entering private information on an HTTP page. HTTPS is useful protection, but it does not prove a website is genuine.

Yes, but cautiously. Threat Memory can use explicitly confirmed malicious reports as supporting evidence in later checks. Campaign Intelligence on the paid plans connects related reports using keyed fingerprints within the personal account or business workspace. Jatzo never compares one customer's mail with another's. Jatzo does not expose another user's raw email or automatically treat its own previous High risk verdicts as ground truth.

Email investigation is the first live tool, not the intended limit of Jatzo. The broader direction is an approachable online-security toolbox, with planned capabilities such as isolated visual investigation of suspicious destinations.

Yes. The first lesson of Phishing fundamentals is free. Every module is included with Business Pro; buying the catalogue on its own is not enabled yet. A completion record is not an accredited qualification.

Every current guide has Beginner friendly and Advanced detail views. Switch views within the same guide to get the explanation you need.

In both, yes, on Personal and above. Jatzo adds a Check this email button and the message is checked by the same engine as the website. In Outlook you add the add-in file from your account page. In Gmail you install Jatzo from the Google Workspace Marketplace, then paste a connection code from your account page once. On Free, upload the .eml file or paste the original email source on the website.

Outlook for Windows, including the new Outlook, Outlook for Mac, Outlook on the web, and Outlook on iPhone and Android. On a phone, Outlook does not give add-ins the delivery details the sender checks need, so the result says what it could not check. Where Jatzo works

Outlook on a phone does not give add-ins the delivery details, so the sender checks cannot run there. The pane says what it could not check, and the same message checked on a computer can score differently for that reason.

This is a limitation of Google’s add-on platform rather than anything in Jatzo, and it affects every add-on built the way Google asks for. With more than one Google account signed in, Google chooses one of them itself when you install, whichever you were looking at, and the install fails. The page it shows says only that it cannot open the file, whatever the real cause was. We cannot change any of that from our side.

For a business, the simplest route avoids it completely. Ask whoever administers your Google Workspace to install Jatzo for the whole domain from the same listing. Nobody then installs anything themselves and the problem never arises. This is how most teams should do it.

Installing it for yourself. Open a private window, sign in to the one Google account you want Jatzo on, and install from there. Signing out of the others works too. Switching accounts first does not, for the reason above.

If your administrator restricts which add-ons may be installed, an install by one person is refused without saying so. A domain install by that administrator is the answer there as well.

If none of those is it, tell us and say which Google account you used and what the page said. Jatzo cannot see a failed install from its side, so we only know about it if you say.

Your privacy matters. Jatzo processes the raw email and its attachments for the analysis, then releases them from application processing; it does not save the raw message or attachment contents in case history. History does keep your email subject as the case title, the date, score and compact findings. Subjects can contain personal information. Temporary URL intelligence and keyed fingerprints are explained in our Privacy Notice.

Supported file parsing runs in a restricted disposable worker. The website still handles uploads and results, and isolation cannot eliminate every security risk. It does not make an attachment safe to open on your own device.

Detailed evidence is temporary for up to 30 minutes and can disappear sooner after a restart or memory limit. The saved case summary remains within your history limit. JPTI exports need their temporary provider evidence. Download important reports promptly; the Case ID links them to your history.

Free covers occasional checks on the website. Personal puts Jatzo inside Outlook and adds the full evidence: links, attachments, technical detail, source IP, live link reputation and PDF reports. Business covers a team, with a login for each person and one allowance shared by everyone. Business Pro adds the Training Centre for everyone you add and bulk checking on the website. Every plan runs the same detection engine.

Bulk checking is part of Business Pro and above, up to 50 per batch. Jatzo processes files in sequence and each successful check uses your allowance. Business Pro keeps up to 1000 cases, Business 500 and Personal 60.

Yes, on every plan, Free included. Jatzo reads QR codes out of attached and inline images, inside the same isolated container that handles every attachment, and checks where the code leads exactly as it would a link you could click. The same checking engine runs whichever plan you are on, so the score is the same: the result says the destination came from a code, so you know what you are looking at, and it says so plainly when a code is the only way to act on a message, which is how this kind of attack is usually built. Personal and above add the attachment evidence behind it: which file held the code, how many of its pages or pictures were read, and what could not be. Paid plans also check the destination against Google Web Risk when it is enabled. Codes on the first three pages of an attached PDF are read the same way: each page is drawn as a picture inside the container, and nothing in the PDF is run. So are codes in the pictures inside an attached Word, Excel or PowerPoint file. A few limits worth knowing: PDF pages after the third are not looked at, and a document with more pictures than Jatzo reads is marked as not fully checked. Older .doc, .xls and .ppt files are not read, and neither are the vector pictures, such as EMF and SVG, that Office uses for some logos and drawings, or images the message only links to rather than attaches. A code Jatzo could not read is not the same as a code that is safe.

Free accounts include clearly labelled ad space. This build uses a Jatzo training promotion without third-party advertising trackers. Personal and above are ad-free.

Paid plans can request a PDF, or a JPTI report, to their registered account address when Jatzo has secure email delivery turned on. You cannot enter another recipient. In a business team, Report this to IT sends the report to the IT email address the workspace admin set instead, and that report names the original sender and the subject. A request accepted for delivery can still be delayed or filtered by your mail provider.

Business and Business Pro provide a workspace with separate logins and one allowance shared by the team. The admin and moderators invite colleagues and can see all retained business cases; members can open their own. An account in a team is a business account, so every check it makes goes to the team. Never share passwords.

Every check made by a business account goes to its workspace. Members can open their own cases, and the workspace admin and moderators can see all retained business cases. Who can see what