Paramant for Outlook: send encrypted attachments from your inbox
The Paramant Outlook add-in encrypts the attachments of a new message or reply and replaces them with burn-on-read links (links that stop working after they have been read). It works in Outlook for Microsoft 365, Outlook 2021 and later, and Outlook on the web. The web app and the extensions delete the file after the first read on every plan. Through the API a paid link can allow more reads: up to 10 reads on Firm and 100 on Enterprise.
Compatibility
- Outlook for Microsoft 365: desktop app on Windows and Mac
- Outlook on the web: outlook.office.com and outlook.office365.com
- Outlook 2021 and later: the standalone desktop version on Windows and Mac
- Outlook 2019, 2016 and 2013, and Exchange Server 2019 on-premises: the add-in needs Office features (Mailbox 1.8) these versions do not have
- Outlook mobile (iOS / Android): add-ins are not supported in mobile Outlook
Installation
Add it with the manifest
The add-in is not in Microsoft AppSource yet. For now you add it with its manifest file: addin.paramant.app/manifest.xml. Save that file.
In Outlook on the web, go to aka.ms/olksideload. That opens Add-ins for Outlook. Choose My add-ins, then under Custom add-ins Add a custom add-in → Add from file, and pick the manifest. The add-in then also appears in Outlook on your computer, for the same account.
Your Microsoft 365 administrator can add it for the whole organisation, see below.
Open the Paramant task pane
After installation, open a compose window. The ribbon shows a Paramant group with the button Encrypt attachment (on the web under the three-dot menu or Apps). Click it to open the task pane on the right.
If you don't see the Paramant button, close and reopen Outlook. In Outlook on the web, hard-refresh the page (Ctrl+Shift+R).
Sign in with your API key
On first run the task pane shows an API key field. Paste your key and click Sign in. The key is kept in the task pane's local storage for eight hours. It goes only to the Paramant relays, not to Microsoft.
Your key is on Account, under Advanced account key. It starts with pgp_. Signing in with email and an authenticator code is not possible in the add-in yet; it is in the Chrome extension.
Sending a file
Attach your files as usual
Attach the files to the message the normal way. Then open the task pane with Encrypt attachment. It lists the attachments with their size. If you added an attachment while the task pane was open, click Refresh list.
Set the expiry and encrypt
Choose how long the link stays active (1 hour to 7 days; your plan may make it shorter). Click Encrypt all attachments. The task pane encrypts each file inside Outlook, uploads it, puts a box with one link per file at the top of your email, and removes the plain attachments.
Send your email normally
The Paramant links are now in the email body. Edit the text around them if you want, then send. Your recipient needs no account: they click the link, download the file once, and the link and file are deleted.
Organisation-wide deployment
Microsoft 365 administrators can push the add-in to all users, so nobody has to install it themselves. In the Microsoft 365 admin center: Settings → Integrated apps → Upload custom apps, choose the Office add-in type, give the manifest URL https://addin.paramant.app/manifest.xml, and deploy to specific users, groups, or the entire organisation. Searching for Paramant under Get apps does not work yet, because the add-in is not in AppSource.
Users get the add-in after a while, usually the next time they restart Outlook. Each user signs in with an API key.
Do not use one shared API key for all users in a large organisation. Transfers from everyone would appear under one account, and revoking the shared key would lock everyone out at once. Use a key per user or per team.