Data retained, retention periods and deletion

Sorvek keeps the inventory built from your sources (directory, applications, accounts, grants) for as long as the service is active. The data is hosted at AWS, in the ca-central-1 region (Montreal), and a few artificial intelligence features call on Anthropic, in the United States. Full erasure of your organization is requested from the Sorvek team.

What Sorvek keeps

• The active source's directory: users (name, email, department, title), groups and members, authentication methods.
• The inventory: discovered applications, accounts, OAuth grants, findings, timeline of each account.
• Evidence emails: for each event, the subject of the email (300 characters at most, email addresses masked) and the sender's address. Only administrators see them.
• Invoices: the extracted amounts and metadata, and the digital fingerprint of the PDF. The PDF itself is not kept.
• Console accounts: name, email, role, last sign-in, and the audit log of actions taken in Sorvek.
• Browser extension data, if you deploy the extension. The details are in What the extension sees and what it sends.

The body of emails is not kept in the inventory. With Microsoft 365, the scan reads it in memory to recognize sign-ups to services; with Google Workspace, it reads only the headers (sender, recipients, subject, date).

Where the data is

The database is at AWS, in Montreal. These features send data to Anthropic, in the United States:

The last two settings are on the Settings > Email analysis page.

How long

Other data, for example the browsing seen by the extension or the audit log, has no guaranteed deletion period: it may remain as long as the service is active, and it goes with the full erasure of the organization.

Erase the subject of evidence emails after a delay

1. Open Settings > Email analysis.
2. In the Retention card, choose Erase after, then enter a delay of 7 to 365 days.
3. Click Save.

After this delay, the subject is erased and the sender is reduced to its domain. The inventory (applications, accounts, dates) is kept.

Delete data yourself

• Deleting a source (Settings > Data sources) erases the inventory collected by that source. The organization's only source cannot be deleted. See Disconnect Sorvek.
• Using Remove on a person in Manage users deletes their Sorvek account if they do not belong to any other organization.
• You can export several inventory lists as CSV (an application's accounts, OAuth grants, MFA coverage, audit log) before any deletion.

Request full erasure

Write to contact@sorvek.com. In Settings > Organization, the Delete organization button in the Danger zone is marked Unavailable: erasure goes through the Sorvek team, which proceeds as follows:

1. It archives your organization: access and collection are cut off. At this stage, nothing has been erased yet.
2. If you ask for it, it gives you a full export of your data (one JSON line per record), without secrets, tokens or passwords.
3. Once the subscription is cancelled, it permanently erases the organization, in a single operation: either everything goes, or nothing does.
4. It can give you the erasure report, which gives the number of rows erased per type of data.

What remains afterwards is the record of the erasure in the platform log (organization name and number of rows erased) and, until they expire, the backup copies of the database.