Sorvek extension · Data and privacy

The Sorvek Discovery browser extension is a security tool reserved for organizations that are Sorvek customers. Your employer or organization (the "organization") decides to deploy it and chooses, feature by feature, what it collects.

Your organization is responsible for the personal information processed by the extension. Sorvek processes it on the organization's behalf, under the contract between them. For any question about how your organization uses this data, contact its IT team first.

This policy applies to the extension on Chrome, Edge, Firefox and other Chromium-based browsers, whether it is installed through a device management policy (Intune, GPO, Jamf) or manually.

Each feature depends on your organization's policy (section 6). The table describes what is sent to Sorvek when a feature is active, and what stays on your device.

Like any web service, Sorvek's servers see your device's IP address on each exchange, including to rate-limit requests. It is not stored with the extension data. The web server's technical logs may contain the IP address and request addresses.

The preview kept is the first 200 characters of the message, after masking on your device. A message of 200 characters or less is therefore kept in full, with only the masked items replaced by a marker.

Masked in the preview: common API keys and tokens recognizable by their format (OpenAI, Anthropic, GitHub, Google Cloud, Stripe, Slack, GitLab, Twilio identifiers, the AWS access key ID "AKIA…" and others; the matching AWS secret access key is not recognized in its usual form and may remain readable), private keys, the value of a secret preceded by a keyword such as "password=", valid credit card, SIN, US social security, Canadian bank account and IBAN numbers when written in a recognized format (for example, a SIN written as nine consecutive digits or an IBAN written in groups of four is neither detected nor masked), the Quebec health insurance number together with its context, and high-severity patterns specific to your organization.

Detected but not masked: email addresses, phone numbers, some identification numbers (including the NEQ, the Quebec driver's licence and US identifiers), numbers shaped like a SIN without being one, code excerpts, names of employees of your organization and medium- or low-severity patterns specific to your organization. These items remain readable in the preview.

If the server detects a secret that escaped masking, it replaces the whole preview with a generic notice. The justification you type (up to 2,000 characters) is kept as is, without masking.

No detector targets health information or other sensitive categories in free text. If you write such information in a message, a justification or a file name, it may be kept. Avoid entering it in AI tools.

• Your sign-in passwords never leave your browser and are never stored. Sign-in detection reads the field only to know whether it is empty. If your organization enables password checks, the extension also compares entries locally, within the authorized scope (section 2). It sends findings, never passwords, the key or the comparison fingerprints.
• Masked fields in developer consoles: on GitHub, Vercel, AWS, Google Cloud and Cloudflare, if your organization keeps API key discovery on (the default setting), the extension also reads, on your device, the masked fields of settings pages, where these consoles show keys and secrets. If a value looks like a key or token, a short, partly masked excerpt may be sent (section 2). Since version 0.31.1, API key discovery reads nothing without the SaaS visibility feature and, before reading anything, skips the fields it recognizes as part of a sign-in, sign-up or password change form, including a password shown with the "show" button. Earlier versions could read on your device the password typed in these forms, for example on the GitHub and Cloudflare sign-in pages; all or part of it could be sent only if it looked like a key or was within 15 characters of a detected key. This exclusion applies to API key discovery; password checks in Discovery 0.33.0 use the separate setting described in section 2.
• Responses from AI tools.
• The content of the files and images you add: it is analyzed on your device. Text you paste is also analyzed on your device, but if it is part of a message sent to an AI tool, it follows the same rules as that message (section 2).
• The content of the pages you visit, except what section 2 describes: the text you send to AI tools, the excerpts around secrets in developer consoles, file names and the address used at sign-in.
• If enrollment fails (network or server unavailable) while AI analysis is checked, a message you then send to an AI assistant built into an application (Gmail, Outlook, Google Docs, Microsoft 365, etc.) may be sent to Sorvek, which rejects it without storing it.

Your organization sets each of the two features, SaaS visibility and AI analysis, to one of three values: employee's choice, required or disabled.

Password checks are off by default. Your organization decides whether to enable them and selects the people and applications involved. It must inform its employees of this use. No additional extension, screen or agreement is requested in the extension. Comparison with the Microsoft or Google account is on by default when the feature is enabled; your organization can turn it off. The known-breach lookup is a separate option, off by default. Without an observed password entry, including when using a passkey or an existing SSO session, the account remains unverified. This feature is not supported on Firefox.

On an unmanaged device: the enrollment page shows the features. Optional features are checked by default. Microsoft sign-in confirms your work account; you can then change your choices before confirming their activation. A required feature is normally enabled and you cannot uncheck it; on an unmanaged device, however, "Decline all" still stops SaaS visibility, even when it is required. "Decline all" stops collection for optional features, but not password checks if your organization enables them. If your organization requires AI analysis, what you send to AI tools may still be recorded.

On a device managed by your organization (Intune, GPO or Jamf policy): the extension enrolls itself with the address provided by your organization, both features are enabled according to its policy and you cannot decline them in the extension. A notice describing the collection is shown at enrollment.

Protection rules: once the extension is enrolled, your organization's rules may block a submission that contains sensitive data, warn you or mask that data, even if you have not consented to AI analysis. If that feature is neither enabled by you nor required by your organization, nothing is sent to Sorvek about that submission. Before enrollment, the extension blocks access to dedicated AI tools.

Changing your mind: on an unmanaged device, the extension's "Open settings" button reopens the enrollment page, where you can change your choices or decline everything. Withdrawing consent stops collection for optional features, but not password checks if your organization enables them. If your organization requires AI analysis, what you send to AI tools may still be recorded. As long as the extension remains installed, it also keeps checking your organization's policy, which updates the last activity date and extension version. Uninstalling the extension stops future collection. Neither withdrawing consent nor uninstalling deletes data already sent: see section 11 for that.

The extension keeps in the browser's local storage, without its own encryption: its installation token, your work email address, your choices, your organization's policy and a queue of events not yet sent.

When sending fails, this queue may contain, for about 7 days, message previews, justifications, file names, the work address used at sign-in and full console addresses with their reduced secret excerpts. The raw copy of the first 4,096 characters, sent for the second analysis, is never put in this queue; of the message text itself, only the 200-character preview can be stored there. The installation token is kept in hashed form on Sorvek's server.

For password checks, the key and comparison fingerprints are kept separately on your device, including across restarts. Web pages and content scripts cannot access them. The affected local data is deleted when this feature is disabled or when the account or authorization changes, once the extension is informed.

If Sorvek is unreachable, the key, fingerprints and reference may remain stored on your device. They are not used while password checks are suspended and remain subject to the retention periods in section 9. After more than 30 days without valid contact with Sorvek, they are deleted at the extension's next check or wake-up, even if the server remains unreachable. If the browser is closed, deletion waits until it resumes. No password value is stored.

Extension data is sent over HTTPS to Sorvek's servers, hosted on Amazon Web Services in the Canada region (Montréal, ca-central-1), where it is stored.

The extension communicates with Sorvek's servers and, during Microsoft sign-in, with Microsoft's sign-in service. If your organization enables the known-breach password lookup, it also queries Pwned Passwords at api.pwnedpasswords.com. That service receives the first five hexadecimal characters of the password's SHA-1 hash and your IP address, but no password, email address, cookie or referring page address. The extension requests a response padded with additional values and compares the rest of the fingerprint locally. This lookup is not performed on the Microsoft or Google account password used as a reference. Data held by Sorvek may then be disclosed to the following recipients:

• your organization's Sorvek console users, according to their role (message previews, justifications and access requests are limited to administrators);
• the tools your organization connects itself: its SIEM (without message previews or justification text), its notification channels such as Slack or Teams (an access request is sent there with your address, the target and your justification), and the AI assistants it connects to Sorvek's MCP server, which can read previews and justifications;
• Anthropic, an AI model provider whose servers may be located outside Canada, for some console features: the name and domain of discovered applications, to categorize them; aggregate counters and, if someone with console access asks for them, the profile of named employees with their applications, for the AI assistant; and, if your organization enables it, for the AI audit: the addresses of the employees who sent the most sensitive messages, with their number, plus accounts discovered in applications (address, name, job title, department, last activity), including those detected by the extension at sign-in. Sorvek sends it neither message previews nor justifications.

At the end of the contract, your organization may request the deletion of all its data. Server backups may contain deleted data for some time. Copies sent to your organization's own tools (SIEM, notification channels) are under its control.

• Encrypted transmission over HTTPS.
• Masking of secrets and some numbers on your device, before the preview is sent (section 3).
• Second analysis on the server to catch a secret that masking missed.
• Installation token unique to each device, kept hashed on the server and revocable by an administrator.
• Console access depends on role: accounts authorized or invited by your organization, and the Sorvek team for support and operations. By default, a person who signs in with a Microsoft or Google account whose email address belongs to your organization's domain may also automatically get basic access (user role), without an invitation: it includes the application and account inventory and the extension statistics, but not the extension data specific to each employee (their browser inventory, observed sign-in method, sign-in log, alerts naming them), which is limited to administrators.

Under Quebec's Law 25 and PIPEDA, you can:

• Access: obtain the data about you collected by the extension.
• Correction: have inaccurate data corrected.
• Deletion: request the deletion of your data.
• Portability: receive your data in a structured, commonly used technological format.
• Withdrawal of consent: for optional features, as described in section 6.

Send your request to your organization, which is responsible for this data, or to Sorvek at the address below: we will handle it with your organization and reply within 30 days.

If you believe your rights are not being respected, you may file a complaint with Quebec’s Commission d’accès à l’information (CAI) or the Office of the Privacy Commissioner of Canada (OPC).