Email DLP Configuration

Each organization in Arbitex has its own Email DLP configuration that controls quarantine behavior, allowed senders, attachment limits, rate limiting, and risk thresholds. Configuration is managed via the admin API and stored as EmailRelayConfig entries per org.

For relay setup and SMTP configuration, see Email DLP Setup. For quarantine management, see Email Quarantine Management.

---

Per-org configuration options

The EmailRelayConfig model exposes the following fields:

Field	Type	Default	Validation	Description
enabled	bool	true	—	Enable or disable Email DLP scanning for this org. When false, messages bypass the scan endpoint and are delivered directly.
allowed_sender_domains	list[str]	[]	Regex-validated domain format	Allowlist of sender domains. An empty list permits all domains. Senders from domains not on the list are rejected at the relay before scanning.
quarantine_policy	str	"quarantine"	quarantine, reject, tag	Action to take when a finding exceeds the risk threshold. See Quarantine policy behavior below.
max_attachment_size_mb	int	10	1–50	Maximum per-attachment size in megabytes. Attachments exceeding this limit are returned as status: "unscanned".
custom_risk_thresholds	dict	null	—	Per-entity-type confidence overrides. When null, the compliance template thresholds or system defaults apply.
rate_limit_per_minute	int	60	1–10,000	Sustained message rate limit (messages per minute per org).
rate_limit_burst	int	120	1–20,000	Burst capacity above rate_limit_per_minute. Must be ≥ rate_limit_per_minute.

---

Configuration API

Read current config

GET /v1/admin/email/config/{org_id}
Authorization: Bearer <admin-token>

{
  "id": 1,
  "org_id": 42,
  "enabled": true,
  "allowed_sender_domains": ["acme.com"],
  "quarantine_policy": "quarantine",
  "max_attachment_size_mb": 10,
  "custom_risk_thresholds": null,
  "rate_limit_per_minute": 60,
  "rate_limit_burst": 120,
  "applied_templates": [
    {"template_id": "hipaa", "rule_count": 13}
  ]
}

The applied_templates array shows which compliance templates are active for the org, with each entry including the template ID and number of policy rules it created.

Create or update config

The PUT endpoint is idempotent — it creates a config record if none exists for the org, or updates the existing one. All fields have defaults, so you only need to include the fields you want to override:

PUT /v1/admin/email/config/{org_id}
Authorization: Bearer <admin-token>
Content-Type: application/json

{
  "quarantine_policy": "reject",
  "max_attachment_size_mb": 20,
  "rate_limit_per_minute": 200,
  "rate_limit_burst": 400
}

Returns 200 OK with the full updated config object.

Read system defaults

Returns the default values applied when no per-org config exists:

GET /v1/admin/email/config/defaults
Authorization: Bearer <admin-token>

{
  "enabled": true,
  "allowed_sender_domains": [],
  "quarantine_policy": "quarantine",
  "max_attachment_size_mb": 10,
  "custom_risk_thresholds": null,
  "rate_limit_per_minute": 60,
  "rate_limit_burst": 120
}

Reset to defaults

Removes all per-org overrides, reverting to system defaults:

DELETE /v1/admin/email/config/{org_id}
Authorization: Bearer <admin-token>

Returns 204 No Content.

---

Default behavior

When no per-org EmailRelayConfig record exists, the system defaults shown above apply. In practice:

• All sender domains are accepted
• Messages with findings above the system risk threshold are quarantined
• Attachments up to 10 MB are scanned
• Rate limiting is enforced at 60 messages/min sustained, 120 burst

Note

The enabled default is true. An org with no config record is protected by Email DLP with system defaults from the moment traffic first flows through the relay. You do not need to explicitly create a config record unless you want to change a default.

---

Quarantine policy behavior

The quarantine_policy field controls the action taken when a DLP finding exceeds the configured risk threshold:

Policy value	Behavior	SMTP response to relay
quarantine	Message is held in the quarantine store. Metadata and raw .eml are stored. Re-delivery requires explicit admin release.	250 OK (message accepted by relay)
reject	Message is refused. A bounce notification is generated. No quarantine record is created.	550 5.7.1 Message rejected by content policy
tag	Message is delivered as-is with an X-Arbitex-DLP-Risk header appended. The header includes the highest-confidence finding type and risk level.	250 OK (message delivered with header)

Tag header format:

X-Arbitex-DLP-Risk: level=high; entity=credit_card; confidence=0.96; scan_id=scan_01HXYZ

Caution

The tag policy delivers potentially sensitive content to recipients. Use it only when a downstream system (e.g., your mail client or SIEM) processes the header to enforce additional controls. For regulated data (HIPAA PHI, PCI payment data), use quarantine or reject.

---

Compliance templates

Compliance templates apply a pre-built set of entity types and risk thresholds to an org’s Email DLP configuration. Templates are channel-agnostic — the same HIPAA template protects your AI gateway and your email channel.

Four templates are available:

HIPAA

File: hipaa.yaml | Entity types: 13 PHI categories

Entity type	Examples
health_info	Diagnosis, treatment, condition references
npi	National Provider Identifier numbers
biometric	Fingerprint, retinal, voice data references
genetic	Genetic test results, DNA references
date_of_birth	Patient DOB
name	Patient name in medical context
telephone	Patient phone numbers
fax	Fax numbers in medical records
email	Patient email addresses
ssn	Social Security Numbers
address	Patient physical addresses
drivers_license	Driver’s license numbers
au_medicare	Australian Medicare numbers

Action mapping:

Risk level	Action
critical	reject
high	quarantine
medium	tag
low	allow

PCI-DSS

File: pci_dss.yaml | Entity types: 8 payment data categories

Entity type	Examples
credit_card	PAN (Primary Account Number)
debit_card	Debit card numbers
pci_data	Generic cardholder data
cvv	Card verification values
bank_account_number	Bank account numbers
ach_data	ACH routing and account data
bearer_token	OAuth/API bearer tokens used in payment flows
magstripe	Magnetic stripe track data

Action mapping:

Risk level	Action
critical	reject
high	reject
medium	quarantine
low	tag

GDPR

File: gdpr.yaml | Entity types: 25 personal data categories

Covers names, email addresses, phone numbers, physical addresses, date of birth, SSN, UK/Indian/Australian national IDs, passport numbers, IP addresses, geolocation data, biometric data, genetic data, health information, and special category data under GDPR Article 9.

Action mapping:

Risk level	Action
critical	reject
high	quarantine
medium	tag
low	allow

SOX/SEC (MNPI)

File: sox_mnpi.yaml | Entity types: 6 material non-public information categories

Entity type	Description
earnings_announcement	Pre-release earnings data or guidance
merger_acquisition	M&A discussions, term sheets, deal references
insider_info	Insider trading-relevant information
material_contract	Significant contracts not yet publicly disclosed
regulatory_action	Pending regulatory actions or investigations
executive_change	Undisclosed executive appointments or departures

Action mapping:

Risk level	Action
critical	reject
high	quarantine
medium	quarantine
low	tag

Applying a compliance template

Templates are applied idempotently via the compliance API. Applying a template stores it as system_config entries for the org — existing custom overrides for fields not covered by the template are preserved.

HIPAA

curl -s -X POST https://platform.arbitex.ai/v1/admin/org/{org_id}/compliance/templates/apply \
  -H "Authorization: Bearer <admin-token>" \
  -H "Content-Type: application/json" \
  -d '{"template": "hipaa", "channels": ["email"]}'

PCI-DSS

curl -s -X POST https://platform.arbitex.ai/v1/admin/org/{org_id}/compliance/templates/apply \
  -H "Authorization: Bearer <admin-token>" \
  -H "Content-Type: application/json" \
  -d '{"template": "pci_dss", "channels": ["email"]}'

GDPR

curl -s -X POST https://platform.arbitex.ai/v1/admin/org/{org_id}/compliance/templates/apply \
  -H "Authorization: Bearer <admin-token>" \
  -H "Content-Type: application/json" \
  -d '{"template": "gdpr", "channels": ["email"]}'

SOX/MNPI

curl -s -X POST https://platform.arbitex.ai/v1/admin/org/{org_id}/compliance/templates/apply \
  -H "Authorization: Bearer <admin-token>" \
  -H "Content-Type: application/json" \
  -d '{"template": "sox_mnpi", "channels": ["email"]}'

Omit the channels field to apply the template across all channels (email, api, gateway, sidecar).

---

Custom risk thresholds

When the compliance template thresholds do not match your organization’s risk tolerance, set per-entity-type confidence overrides via custom_risk_thresholds:

PUT /v1/admin/email/config/{org_id}
Content-Type: application/json

{
  "custom_risk_thresholds": {
    "credit_card": 0.80,
    "ssn": 0.75,
    "health_info": 0.85
  }
}

A finding must exceed its entity type’s threshold to trigger the quarantine policy action. Findings below the threshold are returned in the scan response but do not affect delivery.

Setting custom_risk_thresholds to null removes all overrides and falls back to compliance template values (or system defaults if no template is applied).

---

Rate limiting

Email DLP enforces per-org rate limits using a token bucket algorithm:

• rate_limit_per_minute — the refill rate (tokens added per minute)
• rate_limit_burst — the bucket capacity (maximum tokens at any instant)

A message burst up to rate_limit_burst is allowed immediately. Sustained throughput is capped at rate_limit_per_minute. Messages that exceed the rate limit receive a 452 4.3.1 Insufficient system storage SMTP response — they are not lost, and sending MTAs will retry.

Example: high-volume org

PUT /v1/admin/email/config/{org_id}
Content-Type: application/json

{
  "rate_limit_per_minute": 500,
  "rate_limit_burst": 1000
}

Note

The maximum configurable values are 10,000 per minute and 20,000 burst. Contact support if your volume requirements exceed these limits.

---

Related pages

• Email DLP Setup — Haraka relay installation, TLS, DNS, and verification
• Email Quarantine Management — viewing, filtering, releasing, and deleting quarantined messages
• DLP Pipeline Architecture — 5-tier detection stack, confidence scoring, and policy engine