The Sorvek extension on your device

Your organization installed the Sorvek Discovery extension to know which sites, web applications and AI tools are used at work, and to prevent sensitive company data (access key, card number or SIN) from going to external services. Your organization chooses what the extension collects and is responsible for this data; Sorvek processes it on your organization's behalf.

What the extension does

Depending on your organization's settings, the extension:

• notes the domain name of each site you open, on all sites, and the services these pages contact;
• spots secrets visible in developer consoles: only their type, the page address and the first 4 and last 4 characters of the key are sent;
• spots your sign-ins to applications and the method used. The email address used is sent only if it has the same domain as your work address; otherwise, only the "personal" or "external" label is sent;
• analyzes what you paste into or send to AI tools (ChatGPT, Copilot, Gemini, Claude and others). Sorvek receives a preview of the first 200 characters, where secrets, some numbers, email addresses and phone numbers are masked, the types of sensitive data detected and the outcome (sent, warned, cancelled, blocked). The first 4,096 characters are also sent for a second analysis, then discarded without being stored;
• can, if one of your organization's rules applies, warn you, mask a piece of data or block a submission, and suggest an approved tool;
• lists the extensions installed in your browser;
• sends the name and version of your browser and technical data with no content.

On AI tools, collection applies to all the accounts you use there, including personal use on a work device. Your organization can also turn on other features, described in the privacy policy, for example password checks, which only send findings (weak, reused, found in a known breach).

What the extension does not do

• It does not collect the responses of AI tools.
• It does not send the content of the files and images you add to an AI tool: they are analyzed on your device, and only their name, their type and the result are sent.
• It never sends your passwords. To spot a sign-in, it only checks whether the password field is empty (and, if your organization turns this on, whether the browser filled it in). Password checks happen on your device.
• It does not send the full address of pages (path, parameters), except the path on a few AI agent platforms, such as chatgpt.com.
• It does not take screenshots.

What your IT team sees

The data is linked to your work address. In the Sorvek console, your organization's administrators can see, for each person, the applications and accounts spotted from browsing and sign-ins, the AI tools used with the masked preview of messages, the types of sensitive data detected, the justifications entered, the secrets spotted in developer consoles and the list of browser extensions.

If your organization turns it on, it can also keep, encrypted and for at most 30 days, the first 4,096 characters of messages where sensitive data is detected (with secrets, emails and phone numbers masked). Each time this text is read in the console, the read is logged.

Message previews are deleted after the period your organization chooses (90 days by default). Browsing and sign-ins have no guaranteed deletion period.

Your consent

The extension has two features: SaaS visibility (sites, sign-ins, developer consoles, extensions) and AI analysis (what you send to AI tools). For each one, your organization chooses: left to the employee, required or disabled.

• If the extension enrolled itself (device managed by your organization), you are not offered any choice. A page "Extension deployed by your organization" describes what may be collected; the Got it, close this tab button shows that you have read it.
• If the extension asks you to sign in, you click Sign in with Microsoft, then confirm your choices for the optional features (Confirm my choices or Decline all). A required feature is locked. To change your mind, click the Sorvek icon, then Open settings.

Declining or withdrawing your consent stops collection for the optional features, but not password checks if your organization turns them on. If your organization requires AI analysis, what you send to AI tools may still be recorded. Even without your consent, your organization's rules can block a submission, warn you or mask a piece of data. Withdrawing your consent does not delete data already sent.

Messages you may see

• Sorvek extension required, on an AI tool: on a device managed by your organization, the extension is not connected yet. The page reloads on its own afterwards. If the message stays, contact your IT team.
• AI acceptable use policy: acceptance required (default title): read the policy with Read the policy, then click I accept the policy. The date, the version, the AI tool and whether you opened the policy are recorded.

Your questions

Ask your IT team first: your organization is responsible for this data, and it is through your organization that you exercise your rights of access, correction and deletion. The extension privacy policy describes each piece of data in detail and explains how to reach Sorvek.