I have been looking into Dovecot Sieve, but this is only for incoming mail and i would need it for outgoing.
So i only see Postfix as an option for now, but still have not found an way to only do it for mails leaving the server.
These are some of my current smtp_header_checks:
/^Sensitivity: \s*(Company-Confidential)\s*$/ FILTER smtp:[1.1.1.1]:25
/^Subject: (.*)secure(.*)/ FILTER smtp:[1.1.1.1]:25
But this will also be applied for local delivery.