Frequently asked questions
Short answers to questions from buyers and IT teams: agent, emails, writing to the tenant, hosting, employees, roles.
These answers are short. Each one points to the article that gives the details.
Do we need to install an agent on devices?
No. Sorvek reads Microsoft 365 or Google Workspace through their official APIs, after an administrator authorizes it: nothing to install on devices, no network proxy. The browser extension is optional. It adds visibility into browsing and AI tools, and it is deployed through Intune or Google Admin.
Do we need a specific Microsoft licence?
Not for the basic inventory. The Entra sign-in log requires an Entra ID P1 or P2 licence. Without it, that part is unavailable and the rest of the inventory works.
Read the application inventory
What permissions does Sorvek request?
On the Microsoft side, only read permissions. On the Google side, Sorvek uses a service account with domain-wide delegation. All scopes are read-only, except two that Google does not offer as read-only. Sorvek only uses them to write during a revocation that you launch yourself in real mode.
Does Sorvek read the content of emails?
With Microsoft 365, yes: the Mail.Read permission lets the scan read messages, in memory, to spot sign-ups to services. With Google Workspace, the scan reads only the headers. Sorvek keeps the subject (300 characters at most, addresses masked) and the sender of evidence emails, not their body. There is one exception: if your organization takes part with Sorvek in measuring detection quality, an excerpt of at most 600 characters from some ambiguous emails is kept for 14 days (default setting), then erased. Email analysis can be turned off in Settings > Email analysis, where you can also exclude domains and addresses.
Data retained, retention periods and deletion
Can Sorvek change anything in our tenant?
Not by default. Corrective actions (revoking an OAuth grant, disabling the account of an employee who is leaving) run in Simulation mode: Sorvek records what it would have done, without doing it. Real mode requires two locks: a switch held by Sorvek, and the arming of your organization on the Destructive actions page, with a confirmation phrase. Even in real mode, Microsoft refuses any write, since Sorvek only has read permissions. With Google, a revocation launched in real mode is carried out.
Where is our data hosted?
At AWS, in the ca-central-1 region (Montreal). A few AI features send data to Anthropic, in the United States: the AI assistant with its default provider, application categorization, analysis of OAuth grants, and two options that are off by default. The article on data specifies what is sent for each one.
Data retained, retention periods and deletion
How long until the first inventory?
With Microsoft admin consent, the first scan starts as soon as you connect. With a BYO app registration, you launch it yourself or it starts during the nightly pass; with Google Workspace, it starts during the nightly pass. How long it takes depends on the number of users and mailboxes. Mailbox history then fills in by batches, over several days.
What does the employee see?
With only the connection to Microsoft or Google, nothing on their device. Sorvek does not write to them as long as messaging is not armed by your administrator, which also requires a switch held by Sorvek. With the extension, the employee sees it in their browser and, depending on your rules, gets warnings or blocks. If they install the extension themselves, they choose whether to turn on the parts you leave up to them. On a device managed by your organization, they are not offered any choice: a page tells them what is collected.
The Sorvek extension on your device
Does the extension send the text of AI prompts?
Yes, in part. For each prompt sent to an AI tool, it sends a 200-character preview, masked in the browser before it is sent, which Sorvek keeps. It also sends the first 4,096 characters for a second analysis on the server; this text is discarded after the analysis. If you turn on the Full text of flagged prompts option (off by default), a masked version of these 4,096 characters is kept, encrypted, for flagged messages (14 days by default, 30 at most).
What the extension sees and what it sends
Who in our organization can see the data?
The people to whom an administrator has given a role. Organization view consults the inventory; per-employee data (AI conversations, breaches, extension data, subject of evidence emails) is reserved for the Administrator role. By default, a person from your directory who signs in without an invitation arrives as Restricted, with no access to data.
How do people sign in to Sorvek?
With their Microsoft work account, or Google if that sign-in is offered. Sorvek does not create passwords, and MFA is handled by your identity provider. A session lasts 4 hours at most.
How long does Sorvek keep our data?
The inventory stays as long as the service is active. AI prompt previews and secrets detected by the extension are deleted after the period you set (90 days by default, from 7 to 365), and the log of messages sent to employees after 180 days. The browsing seen by the extension, the subject of evidence emails and the audit log have no guaranteed deletion period: they may stay as long as the service is active. For email subjects, you can choose erasure after a delay, which applies when the page shows Erasure active.
Data retained, retention periods and deletion
Can we stop everything and erase everything?
Yes. You pause the source, remove access at Microsoft or Google, then request erasure at contact@sorvek.com. The Sorvek team archives the organization, gives you an export if you want one, then erases the organization. All that remains is the record of the erasure and, until they expire, the backup copies.
Can’t find your answer?
Already a customer? The support bubble at the bottom of the app sends your question with its context. Otherwise, write to the Sorvek team.