Roles and access

Each person has a role in your Sorvek organization, and that role decides what they see and what they can do. Only an Administrator assigns roles and invites colleagues, from Settings > Manage users. Sign-in goes through your Microsoft account (or Google, if that sign-in is offered), and a session lasts 4 hours at most.

The roles

• Only an Administrator changes an application's owner, approval status, criticality, licence or category, or merges two applications.
• Only an Administrator sees per-employee data: the AI conversations and Breaches pages, the browser extension data, and the subject and sender of evidence emails. A read-only MCP server key, which an administrator creates, also has access to it.
• By default, launching a scan, revoking an OAuth grant, arming actions or configuring an integration is reserved for the Administrator. Simulation mode and the double lock are described in OAuth grants and revocation.
• The list also offers Personal view: this role gives the same access as Restricted.
• Two labels can appear that you cannot assign: Sorvek team (accounts of the Sorvek team, managed outside your organization) and Partner (read-only access to the organizations shared with them).

Adjust an action for one person

The Settings > Advanced permissions page grants or removes a sensitive action for a specific person, for example Launch scans or Export. Without a specific setting, each action follows the person's role.

Invite a colleague

1. Open Settings > Manage users.
2. In the Invite a person card, enter the person's sign-in address (for Microsoft, their username).
3. Choose their role: Organization view (suggested by default), Organization view and departures or Administrator.
4. Click Invite.

The person receives an email with a link that is valid for 7 days. They open it, then sign in with their work account. The invitation appears under Pending invitations until it is accepted, and Revoke cancels it.

Give a role without an invitation

The People table also lists the people in your directory who have never signed in. You can choose a role for them in advance (status Pre-assigned role): it will apply at their first sign-in.

A person from your directory who signs in without an invitation or a pre-assigned role receives the Role for new arrivals, set on the same page. By default, it is Restricted: the person arrives as Waiting for a role and administrators are notified. You can choose Organization view as the default role; it only applies if the directory of your active source confirms the person's identity.

A role change applies from the person's next action. Remove removes a person from the organization. You cannot remove yourself, or remove the last administrator.

Sign in

The sign-in page offers Continue with Microsoft and Continue with Google. The Google button is active only if Google sign-in is enabled on the platform; otherwise, it shows Not configured. Personal accounts (Outlook, Gmail) are refused: a work account is required.

Sorvek does not create any passwords for your users.

Session length

A session lasts at most 4 hours after sign-in, even if you are active. After that, Sorvek asks you to sign in again. With Microsoft, the sign-in screen asks for your credentials again at each new sign-in. Sign out ends the session right away.

MFA

Multi-factor authentication is handled by your identity provider: Sorvek does not check it itself. To require it, target the Sorvek application in a Microsoft Entra Conditional Access policy, or enforce 2-Step Verification in Google Workspace.

Learn more

• Data retained, retention periods and deletion
• Disconnect Sorvek