Sorvek extension · Data and privacy

The Sorvek Discovery browser extension is a security tool reserved for organizations that are Sorvek customers. Your employer or organization (the "organization") decides to deploy it and chooses, feature by feature, what it collects.

Your organization is responsible for the personal information processed by the extension. Sorvek processes it on the organization's behalf, under the contract between them. For any question about how your organization uses this data, contact its IT team first.

This policy applies to the extension on Chrome, Edge, Firefox and other Chromium-based browsers, whether it is installed through a device management policy (Intune, GPO, Jamf) or manually.

Each feature depends on your organization's policy (section 6). The table describes what is sent to Sorvek when a feature is active, and what stays on your device.

Like any web service, Sorvek's servers see your device's IP address at each exchange, in particular to rate-limit requests. It is not stored with the extension data. The web server's technical logs may contain the IP address and the address of requests, including the email address typed on the enrollment page.

The preview kept is the first 200 characters of the message, after masking on your device. A message of 200 characters or less is therefore kept in full, with only the masked items replaced by a marker.

Masked in the preview: common API keys and tokens recognizable by their format (OpenAI, Anthropic, GitHub, Google Cloud, Stripe, Slack, GitLab, Twilio identifiers, the AWS access key ID "AKIA…" and others; the matching AWS secret access key is not recognized in its usual form and may remain readable), private keys, the value of a secret preceded by a keyword such as "password=", valid credit card, SIN, US social security, Canadian bank account and IBAN numbers when written in a recognized format (for example, a SIN written as nine consecutive digits or an IBAN written in groups of four is neither detected nor masked), the Quebec health insurance number together with its context, and high-severity patterns specific to your organization.

Detected but not masked: email addresses, phone numbers, some identification numbers (including the NEQ, the Quebec driver's licence and US identifiers), numbers shaped like a SIN without being one, code excerpts, names of employees of your organization and medium- or low-severity patterns specific to your organization. These items remain readable in the preview.

If the server detects a secret that escaped masking, it replaces the whole preview with a generic notice. The justification you type (up to 2,000 characters) is kept as is, without masking.

No detector targets health information or other sensitive categories in free text. If you write such information in a message, a justification or a file name, it may be kept. Avoid entering it in AI tools.

• Your passwords: at sign-in, sign-in detection only checks whether the field is filled in. On GitHub, Vercel, AWS, Google Cloud and Cloudflare, API key discovery also reads password fields on your device: if a value looks like a key or token, a short, partly masked excerpt may be sent.
• Responses from AI tools.
• The content of the files and images you add: it is analyzed on your device. Text you paste is also analyzed on your device, but if it is part of a message sent to an AI tool, it follows the same rules as that message (section 2).
• The content of the pages you visit, except what section 2 describes: the text you send to AI tools, the excerpts around secrets in developer consoles, file names and the address used at sign-in.
• Before you enroll, nothing other than the email address typed on the enrollment page, the extension version, and your choices on that page (options checked, or a refusal). Exception: if enrollment fails (network or server unavailable) while AI analysis is checked, a message you then send to an AI assistant built into an application (Gmail, Outlook, Google Docs, Microsoft 365, etc.) may be sent to Sorvek, which rejects it without storing it.

Your organization sets each of the two features, SaaS visibility and AI analysis, to one of three values: employee's choice, required or disabled.

On an unmanaged device: the enrollment page shows the features. Optional features are checked by default. Signing in with Microsoft enables the features as they are checked at that moment; to uncheck them before activation, first type your work email. A required feature is normally enabled and you cannot uncheck it; on an unmanaged device, however, "Decline all" still stops SaaS visibility, even when it is required. "Decline all" stops collection for optional features; if your organization requires AI analysis, what you send to AI tools may still be recorded.

On a device managed by your organization (Intune, GPO or Jamf policy): the extension enrolls itself with the address provided by your organization, both features are enabled according to its policy and you cannot decline them in the extension. A notice describing the collection is shown at enrollment.

Protection rules: once the extension is enrolled, your organization's rules may block a submission that contains sensitive data, warn you or mask that data, even if you have not consented to AI analysis. If that feature is neither enabled by you nor required by your organization, nothing is sent to Sorvek about that submission. Before enrollment, the extension blocks access to dedicated AI tools.

Changing your mind: on an unmanaged device, the extension's "Open settings" button reopens the enrollment page, where you can change your choices or decline everything. Withdrawing your consent stops collection for optional features; if your organization requires AI analysis, what you send to AI tools may still be recorded. As long as the extension stays installed, it also keeps checking your organization's policy, which updates the last-activity date and the extension version. Uninstalling the extension stops future collection. Neither withdrawing consent nor uninstalling deletes data already sent: for that, see section 11.

The extension keeps in the browser's local storage, without its own encryption: its installation token, your work email address, your choices, your organization's policy and a queue of events not yet sent.

When sending fails, this queue may contain, for about 7 days, message previews, justifications, file names, the work address used at sign-in and full console addresses with their reduced secret excerpts. The raw copy of the first 4,096 characters, sent for the second analysis, is never put in this queue; of the message text itself, only the 200-character preview can be stored there. The installation token is kept in hashed form on Sorvek's server.

Extension data is sent over HTTPS to Sorvek's servers, hosted on Amazon Web Services in the Canada region (Montréal, ca-central-1), where it is stored.

The extension communicates only with Sorvek's servers and, when you sign in with Microsoft, with Microsoft's sign-in service. The data may then be disclosed to the following recipients:

• your organization's Sorvek console users, according to their role (message previews, justifications and access requests are limited to administrators);
• the tools your organization connects itself: its SIEM (without message previews or justification text), its notification channels such as Slack or Teams (an access request is sent there with your address, the target and your justification), and the AI assistants it connects to Sorvek's MCP server, which can read previews and justifications;
• Anthropic, an AI model provider whose servers may be located outside Canada, for some console features: the name and domain of discovered applications, to categorize them; aggregate counters and, if someone with console access asks for them, the profile of named employees with their applications, for the AI assistant; and, if your organization enables it, for the AI audit: the addresses of the employees who sent the most sensitive messages, with their number, plus accounts discovered in applications (address, name, job title, department, last activity), including those detected by the extension at sign-in. Sorvek sends it neither message previews nor justifications.

At the end of the contract, your organization may request the deletion of all its data. Server backups may contain deleted data for some time. Copies sent to your organization's own tools (SIEM, notification channels) are under its control.

• Encrypted transmission over HTTPS.
• Masking of secrets and some numbers on your device, before the preview is sent (section 3).
• Second analysis on the server to catch a secret that masking missed.
• Installation token unique to each device, kept hashed on the server and revocable by an administrator.
• Console access depends on role: accounts authorized or invited by your organization, and the Sorvek team for support and operations. By default, a person who signs in with a Microsoft or Google account whose email address belongs to your organization's domain may also automatically get basic access (user role), without an invitation, which includes the application and extension inventory.

Under Quebec's Law 25 and PIPEDA, you can:

• Access: obtain the data about you collected by the extension.
• Correction: have inaccurate data corrected.
• Deletion: request the deletion of your data.
• Portability: receive your data in a structured, commonly used technological format.
• Withdrawal of consent: for optional features, as described in section 6.

Send your request to your organization, which is responsible for this data, or to Sorvek at the address below: we will handle it with your organization and reply within 30 days.

If you believe your rights are not being respected, you may file a complaint with Quebec’s Commission d’accès à l’information (CAI) or the Office of the Privacy Commissioner of Canada (OPC).