Outtake Verify - FAQ
If your question is not answered here, please contact us at support@outtake.ai
An enterprise invites employees to use Outtake Verify for Email. At signup, the enterprise's SSO system validates that the user is the rightful owner of the email account, while the HRIS system provides the link between the user's email address, verified name, and organizational position.
Once identity is established, users set up an authentication method linking their validated identity to their device. When sending emails, users authenticate via their chosen method, with enterprise-determined session lengths allowing multiple emails to be sent as Verified from a single authentication (sessions can last up to one day). This keeps the process low-friction and user-friendly.
After authentication, the email becomes "Verified." The Outtake Verify extension hashes the email content and stores this hash along with the message ID and authentication signature as a verification record—no raw email, sender, or recipient information is processed or stored by Outtake. Verify only operates on user actions- it will never send emails on your behalf without you clicking "Send Verified.” It does not record
When recipients also use Outtake Verify, the system compares verification records between sent and received emails. Matching records trigger a Verified badge in the email's top right corner, confirming both sender identity and message integrity. Recipients can hover over the badge to see authentication method, profile photo, full name, position, and company name. The badge also enables inbox prioritization to show only Verified emails.
Single Sign On (“SSO”) is an authentication technology supported by industry protocols. It allows a user to log in once with a single ID governed by a central identity provider (ie, an employer) to access multiple software systems.
Passkeys are a simpler and more secure alternative authentication method than passwords. They let you sign-in to websites or apps with just your fingerprint, face scan, or screen lock. Passkeys are built on industry standards and supported by major providers such as Apple, Microsoft, Google, and 1Password. They utilize public and private keys (public key cryptography). Each passkey is specific to the site you are logging into and is stored on your local device, so unlike passwords cannot be guessed or reused by attackers. You can read more about passkeys on the FIDO Alliance website or on any passkey provider website, such as Google.
Outtake Verify for Email leverages the power of passkey industry protocols for secure authentication. After a user completes SSO at onboarding, the user is prompted to select an authentication method. If the user selects passkey, Outtake Verify prompts the user to create a passkey via the enterprise approved passkey provider. This passkey will be re-used regularly to authenticate and send emails with an Outtake Verify badge.
World ID is a simple, secure way to prove you are a real and unique human without sharing your personal information. A verified World ID provides an anonymous, reusable “proof of human” credential to distinguish between humans and bots online. World ID is built on an open source, decentralized and permissionless protocol.
After a user completes Single Sign On (“SSO”) at Outtake Verify onboarding, the user is prompted to select an authentication method to send emails with an Outtake Verify badge. If the user selects World ID, a QR code appears within the web app. The user unlocks their World App on their mobile phone and scans the QR code, tying their World ID via a Zero Knowledge Proof (ZKP) to the identity that was proven via SSO. They can then use their World app to regularly authenticate and send emails with an Outtake Verify badge.
Yes.
Administrators can configure Outtake Verify so that the default Send button becomes Send Verified. This ensures that the standard send action (including the CMD + Enter shortcut) will send a Verified email by default. Your email client’s native Send button remains accessible in the More menu, so users still have the option to send without verification if needed.
IT administrators can enable sticky sessions to reduce the frequency that users are challenged to authenticate before sending a Verified email. With sticky sessions enabled, the system will remember the last successful verification on a given device and reuse it for a limited time. The exact session duration is configurable by administrators. By default, sticky sessions are disabled for all organizations, and they must be explicitly turned on by an administrator.
