Classification, made clear.

ClassifyIt integrates into Microsoft Office: Outlook, Word, PowerPoint and Excel.

ClassifyIt and CryptIt appear in the ribbon, right where you work.

Choose a classification and release audience. Insert applies your selected marking.

The visible marking helps readers recognise the sensitivity of the information.

In the background, the iCLASS standard expresses classification and release information as structured metadata.

Next, use CryptIt to export a Trusted Data Format container.

Encrypted content. Readable metadata. The private key stays outside the container.

Classify. Standardise. Protect. Try ClassifyIt at classify it dot E U.

Before you share a document or email, two questions matter. How sensitive is the information? And who may receive it?

ClassifyIt applies your organisation's classification levels. For example: Public, Restricted, Confidential and Secret. Your policy defines what each level means.

Classification describes sensitivity. Release information identifies the permitted audience, such as named departments or partner organisations. Sharing still requires the appropriate authorisation.

Work in classic Outlook, Word, PowerPoint and Excel. ClassifyIt is available in the ribbon, right where you create your information.

Select a classification and the release audience. Apply the marking so readers can recognise how the information should be handled.

Behind the visible marking, the iCLASS standard represents classification and release information as structured metadata, for compatible systems to interpret.

Bring your classification policy into everyday work. Explore ClassifyIt seven and download the trial at classify it dot E U.

Different organisations use different classification markings. iCLASS adds a shared language, so people and compatible systems can understand the information they receive.

Keep the original classification marking. Add an iCLASS label alongside it. Your policy remains authoritative, and any mapping between organisations requires the appropriate agreement.

Three fields carry the essential context. The originator identifies who classified the information. The classification describes sensitivity. Releasability identifies the permitted recipient entities, subject to the applicable authorisation.

iCLASS defines seven classification levels, from Public to Top Secret. An implementation can use only the levels it needs. Many organisations use three or four.

A readable label tells people the originator, sensitivity and release conditions. The corresponding JSON carries the same information for compatible systems, without relying on the visible text alone.

iCLASS also defines a short, readable label for paragraph markings. For example, R, Belgium and USA means Restricted, releasable to Belgium and the United States. R, R E L indicates that a release caveat exists.

ClassifyIt seven brings iCLASS into Microsoft Office and carries the classification context into its Trusted Data Format exchanges. Protection and access decisions depend on the configured policy and implementation.

Build a shared understanding across organisational boundaries. Explore the full iCLASS standard and try ClassifyIt seven at classify it dot E U.

This video shows how iCLASS bridges different national classification markings. Protecting information starts with understanding its sensitivity, and making that visible through document markings. ISO/IEC 27001 and German IT-Grundschutz address classification and labelling. Markings also support the protection measures required by GDPR.

Would you know that all of these mean the same classification level: secret? Different languages. Different national markings. Understanding the words is only the first step. The applicable policy defines their protection requirements.

iCLASS defines seven common levels. Public at the bottom, then unclassified, official, restricted, confidential, secret, and top secret. Organisations use the levels they need. National markings can be mapped into this common representation using the applicable policies and agreements.

Germany and the United States use different markings. Greek, Spanish and Finnish markings add further languages. Each country uses its own scheme; there does not have to be a national equivalent for every iCLASS level. Unclassified does not automatically mean approved for public release.

German geheim and American secret represent equivalent classification levels. When exchanged under the applicable security agreement, they must receive equivalent protection. iCLASS represents both at the common secret level, while preserving their origin. Detailed national handling rules still apply.

Here is a German document marked geheim. Add an iCLASS marking identifying Germany as the originator and secret as the common level. The original marking remains visible. A recipient can understand the shared classification without losing its national context.

Now add releasability to the United States. The classification tells us how to protect the information. Releasability identifies the authorised receiving countries, subject to policy and agreements. The label records that decision; it does not itself grant permission to release the document.

People can read the visible marking. Software can read the corresponding classification, origin and releasability from metadata to support handling and protection decisions. Different national markings. A common understanding. iCLASS connects classification, origin and releasability.

This video explains how digital certificates work. We will use a document, an envelope, a padlock and a matching key.

Bob has two mathematically connected parts: a public key and a private key. His public key is contained in a digital certificate, together with information identifying its owner. Bob can share his public certificate. His private key stays secret and protected. Sharing the certificate does not share the private key.

Think of Bob’s public key as an open padlock, and his private key as the matching key. Alice has a document and Bob’s open padlock. She places the document inside an envelope, closes the envelope, and snaps the padlock shut. Anyone can close this lock. Alice sends the locked envelope to Bob. Only Bob’s matching private key can open the padlock. He unlocks it, opens the envelope, and takes out the document.

Now imagine Charly carries the locked envelope from Alice to Bob. He can carry or copy the encrypted message, but without Bob’s private key, he cannot decrypt its contents. Bob’s software uses his private key to recover the original document.

The same works in the other direction. Alice has her own public certificate and private key. She shares her public certificate with Bob and other senders. They can now encrypt files for Alice. Her matching private key lets her open them. Charly can deliver these encrypted files too, without reading their contents.

You can also protect one message for several recipients. Imagine the envelope has a separate padlock for Bob, Alice and Dana. These are alternative ways in, not locks that must all be opened together. Each recipient uses their own matching private key. Bob can open the document with his key. Alice can open it with hers. Dana can use hers. Any one of these authorised recipients can open the same document.

Before using a certificate, check that it really belongs to the intended recipient through a trusted process. Keep your private key protected. Anyone who obtains it may be able to decrypt files intended for you. Remember: share your public certificate so others can send you protected information. Keep your private key to open it.

Create a new email in Outlook. ClassifyIt immediately applies the default marking configured by your administrator.

In this example, the configuration uses Traffic Light Protocol, or TLP, markings. It also displays an iCLASS label beneath the classification. The default is TLP Green, with the configured iCLASS label showing Restricted.

Enter the recipient, subject and message as usual. Here, we are preparing a message requiring Secret classification.

Open Quick Select and choose Red. ClassifyIt updates the marking to TLP Red and, in this configuration, changes the iCLASS label to Secret.

For more detailed settings, click the upper ClassifyIt button to open the full classification form.

Keep Red selected and choose the appropriate release entities. Here, we select Cyber and Operations. The preview shows the resulting markings. Click Insert to apply them to the email.

The email now displays the classification, release conditions, and corresponding iCLASS label. When your message is ready, send it as usual.

Quick Select gives you fast access to frequently used markings. You can add your own entry, including its classification and release selection.

Open the full classification form using the upper ClassifyIt button. Select Amber, then Management, Finance, and Human Resources. Check the complete marking in the preview.

At the top of the form, choose Manage Quick Select. Click Add Current to save the classification and release combination you have just selected.

Enter a recognisable display name for the menu entry, then choose a coloured stamp icon. Here, we use an amber stamp. The display name is a shortcut label; the saved marking retains every selected release entity.

The new entry appears in the list. Use Move Up or Move Down to put it where it suits you. Here, we move it just below Amber.

Click OK to save your Quick Select settings. Then close the classification form and return to your email.

Open Quick Select again. Your new entry is now available. Select it to apply the full marking, including Management, Finance, and Human Resources, together with the configured iCLASS label.

Your frequently used classification and release combination is now ready whenever you need it. Personalise Quick Select to match the way you work.

This video shows how to encrypt email attachments with CryptIt using PIN protection, and how the recipient decrypts them. All CryptIt encryption modes support any file type. Here, we demonstrate PIN mode with a Word document. Prepare your email and attach the file as usual.

Open the CryptIt menu and choose PIN. This selects PIN protection for the email attachments.

Enter the PIN and confirm. Show password lets you check what you entered. The CryptIt menu also deliberately displays the active PIN, so you can see which secret will be used. This example uses a demonstration PIN.

Press the upper CryptIt button to encrypt the attachment. It becomes a protected Trusted Data Format container, with a dot TDF file extension added to the original filename.

If the email contains several attachments, CryptIt encrypts all of them with the same PIN. While this PIN protection remains active, further attachments added to the message are encrypted too.

Before sending, apply the intended Amber marking to the email. The message body remains readable; PIN protection encrypts the attachments. Send the email as usual, and communicate the PIN to the recipient separately.

The recipient opens the email and sees the protected Trusted Data Format attachment. To recover the original file, use CryptIt to decrypt it.

Enter the same PIN and confirm. With the correct PIN, CryptIt restores the original attachment. The recipient can then save it or open it in the appropriate application.

Here, the Word document opens with its classification markings retained. Protect attachments with a PIN, then let the recipient decrypt and use the original file.

This video shows how ClassifyIt prevents a user from lowering the classification when replying to or forwarding a classified email. Here, we demonstrate the rule with Reply All.

The received message carries a German protective marking and an iCLASS restricted label. The user chooses Reply All. In this configured policy, the reply starts with a green marking, also representing restricted.

The user writes a reply and tries to select the lower classification through the white Quick Select entry. Writing unclassified in the message does not change the classification rule.

ClassifyIt rejects the selection. The error says the selected classification is lower than the previous email classification. The reply cannot be downgraded below the original message. The original restricted content remains in the conversation.

The user adds more sensitive information and selects amber instead. This configured policy maps amber to confidential. The higher classification is accepted, and the reply now displays the confidential iCLASS marking.

Replies and forwards must retain at least the classification of the original message. They can be raised when the new content requires stronger protection. ClassifyIt helps keep the classification consistent as the conversation continues.

This video demonstrates a certificate-based encryption use case from scratch in CryptIt. We create our own certificate and private key, exchange public certificates, and encrypt an email attachment.

First, create your own digital certificate with its matching private key. Open the CryptIt menu and choose Certificate Management. If you have no current certificate, select Generate New. CryptIt guides you through the setup. You will need your email address and a password to protect your private key.

Enter your complete email address. Then choose a strong certificate password with at least ten characters. The simple password shown here is only a demonstration. Keep this password safe: CryptIt warns that it cannot be recovered. This protects your private key; it is not a password that you send to recipients. CryptIt confirms that your certificate has been created. Share the public certificate. Keep the private key protected.

Prepare your email and attach the file. This example uses a Word document, but attachment encryption supports any file type. Open the CryptIt menu and select Certificate. Then press the upper CryptIt button to encrypt the attachment. Here, CryptIt warns that the recipient’s public certificate is missing. To protect the attachment for that recipient, you first need their public certificate.

Ask the recipient to send you their public certificate. You can share yours at the same time. In the CryptIt menu, choose Attach my Public Key. CryptIt attaches your public certificate in a package with a dot CRT, dot TDF filename ending. Your private key is not included. The recipient can use your public certificate to send encrypted attachments back to you.

The recipient replies with their public certificate attached. CryptIt recognises that it is not yet in your trusted certificate folder and offers to import it. Before accepting, verify through a trusted process that the certificate belongs to the intended recipient. Importing a certificate does not, by itself, establish someone’s identity. Confirm the import. CryptIt reports that the public certificate has been imported.

Return to your prepared email and press CryptIt again. The original attachment becomes a protected Trusted Data Format container, with a dot TDF file extension added to its filename. The recipient’s public certificate allows CryptIt to protect the attachment for them. Their matching private key allows them to decrypt it. Send the email as usual. The attachment is encrypted; the email body remains readable.

CryptIt also includes the sender, so you can reopen your own encrypted attachment from the sent message. Open the message and press CryptIt. When prompted, enter your certificate password to unlock your private key. The original attachment is restored and can be opened or saved. The recipient decrypts their copy using their own matching private key and certificate password.

Create your certificate. Exchange and verify public certificates. Select Certificate mode and encrypt. Share your public certificate, not your private key or its password. CryptIt’s integration into Outlook, together with certificates named after email addresses, makes strong encryption mechanisms easy to use to protect the confidentiality of attachments.

Create a Word document, apply its classification, and export an encrypted Trusted Data Format container directly from File Explorer.

Start with a Word document saved in your working folder. This example uses a file called restricted file dot doc x.

Open the document in Word and add your content. The ClassifyIt controls are available on the Home ribbon.

Open the ClassifyIt menu and choose the appropriate classification. Here, the configured Quick Select entry is VS-NfD, for restricted information.

ClassifyIt applies the configured header and footer markings. Here, the header shows the German restricted marking and its machine readable iCLASS representation. The diagonal text is part of this demonstration document.

Save your changes. The document now carries its classification for the next steps in the workflow.

Back in File Explorer, the ClassifyIt Shell extension shows a coloured stamp on the Word file icon. In this configuration, the restricted classification uses a teal stamp.

Right click the classified document and choose Export as C I, TDF. This is the menu command shown for creating the Trusted Data Format container.

The export confirms that the file already carries its own classification. That classification is used unchanged. Choose OK to continue.

Select the protection mode. This example uses Generic encryption, which everyone with ClassifyIt can decrypt. Choose PIN or Certificate when access should depend on a shared PIN or selected recipients. No Encryption signs and classifies the container, but does not encrypt it.

The new file, restricted file dot doc x dot TDF, appears beside the original Word document. The original remains in place, and the container also displays its classification colour and ClassifyIt stamp.

From document markings in Word to classification icons and encrypted export in File Explorer. Learn more at classify it dot E U.

This video shows how ClassifyIt checks attachment classifications before an email is sent. A restricted document is attached to a public email. Watch what happens when the two levels do not match.

The Word document is classified restricted. The new email is marked public, shown here as offen. The user attaches the restricted document. The attachment is more sensitive than the email containing it.

The user presses Send. ClassifyIt intercepts the send operation and compares the attachment’s classification with the email. It detects the higher classification and warns the user before the message leaves.

The administrator decides whether a user may override this warning or whether the mismatch must block sending. This example allows an override: OK would send anyway. The user chooses Cancel instead, returning to the draft to correct the email classification.

The user opens Quick Select and chooses VS-NfD. The email is reclassified as restricted. Its visible German marking and iCLASS label now reflect the same classification level as the attachment.

Now the email and attachment are both restricted. The user presses Send again, and the email is sent. ClassifyIt has helped the user correct the mismatch before sharing the information.

An email’s classification should reflect the information it carries, including its attachments. ClassifyIt checks the difference at sending time. Your organisation’s policy determines whether a mismatch is a warning that can be overridden or a mandatory block.

CI-TDF, the ClassifyIt Trusted Data Format, is based on Open TDF and establishes data protection by bringing encrypted content and its protection information together.

Here is a readable document and an empty container. As the document enters, its content is encrypted and becomes unreadable. A JSON manifest is added alongside it, describing the file and the mechanisms needed to use it securely.

Let us look inside the manifest. The version field identifies the format as CI-TDF, version one point zero. The payload section describes the original file and the stored payload.

Root signature protects the whole manifest, including its assertions and key access information. Together with the payload hash and authenticated encryption, this allows changes to be detected. Verification uses a digital signature or a keyed integrity check, depending on the mode.

The key access section describes how a recipient recovers the content encryption key. Here, certificate access carries a wrapped key, which requires the recipient’s matching private key. The plaintext content key is never exposed in the manifest.

Further down, the iCLASS assertion describes the information’s classification. Here, BEL identifies Belgium as the originator. R means Restricted. The release list names Germany and the United States, subject to the originating organisation’s policy and required agreements. The assertion is protected by the manifest’s root integrity check.

The recipient uses their matching private key to recover the content key. After successful integrity verification, the document is decrypted and readable again. The private key stays with the recipient.

A Key Access Server is planned alongside local access. It will verify identity and evaluate policy before releasing the protected key to an authorised recipient.

Protection travels with the data, a building block for Data Centric Security and Zero Trust. Explore the CI-TDF specification under Documentation at classify it dot E U.