Frequently asked questions

A tool that scans for the keywords your organisation defines, within the frame of adherence to its policies. In Exchange (Exchange Online and on-premises Exchange Server), OneDrive, Microsoft Teams and on-premises disks (DiskScanner), for employees who have given permission, it scans for your organisation's keywords and patterns and reports. The organisation takes the action on the findings; every administrative step is recorded.

• Exchange: Exchange Online and on-premises Exchange Server; subject and message body. Attachments and online archive mailboxes are not scanned.
• OneDrive: Word, Excel, PowerPoint, PDF, CSV and plain-text files. Images and scanned documents are not read. Files shared outside the organisation are flagged next to the findings.
• Microsoft Teams: one-to-one chats; only the messages an employee sent, if that employee gave permission. Those messages may also contain personal data of the other person in the chat.
• DiskScanner: on-premises disk areas; older data that never moved to the cloud.

Your organisation. Four parts: keywords (CSV import), patterns (no regex skills needed), user group selection, and trying the rules on sample text before scanning (Test rules). Whether a keyword or pattern is appropriate is your assessment.

Are there ready-made rule packs? Yes, as an option: Turkish national ID (TCKN), Turkish IBAN, IBAN from any country, payment card number, Turkish phone number, e-mail address and passport number. The ID, IBAN and card rules are also checked by checksum. Packs are switched on separately and tried on sample text with Test rules.

No. You enter keywords or import them as CSV; patterns need no regex skills. You can try the rules on sample text before scanning.

The results show the rule that matched; the value found is not recorded. To see the full content, Reveal asks for a duration, a reason and a request number; every view is written to the audit log. Access to the results depends on the roles you assign; we recommend limiting it to the fewest people necessary for the purpose.

No. Action modes stay off until an administrator turns them on. You can always start with Safe Scan, which scans and reports only and touches nothing. Selective Action: a person reviews the findings; the action is applied only to the items they tick. Direct Action: when you trust the rules, scan and action happen in one run; items are not put to a person one by one.

You set a hard action limit for each scan area: the number of items processed in one run. A run that would exceed the limit stops. There is no button to override the limit: an administrator has to raise it, and that change is recorded. In Direct Action, items processed before the limit was reached stay processed; the run is recorded as failed. And if the audit log cannot be written, the action is refused.

In Exchange, OneDrive and Teams an action cannot be reversed; the product has no feature that reverses it. That is why an action is protected by modes, the hard action limit, roles and the audit log. Before an action, a copy of each OneDrive file is placed in your own Azure storage and kept for 90 days by default; if the copy cannot be made, no action is applied to that file. To get a copied file back you take it from your own storage; keep access to those copies limited too. No copy is taken of Exchange e-mail. Our technical team can tell you how your Microsoft 365 retention policies or holds interact with actions.

Can data we are legally required to keep fall within an action? If that data is in the scan scope, yes. So keep the mailboxes and accounts that hold data under a retention duty out of scope. The product has no legal hold feature; exclusion is done through the scope settings (user group and account selection, date range, rule selection).

Scans are runs you start, in the periods set in your organisation's policy and announced in advance in your notice to employees. They are never hidden or unannounced, never run without pause and never process each message as it arrives. The Board's principle decision expects content review that is indeterminate in scope, general or ongoing to be avoided; whether a content scan is necessary and proportionate is your organisation's assessment. For Exchange a scheduled scan can be defined; its timing should match the periods announced in your notice, and the scope is still narrowed with user group, date range and rule selection. Ready-made rule packs work in on-demand scans; in scheduled scans, whether your own keywords and patterns are appropriate is your assessment.

Every administrative step: configuration changes, scans, actions, limit changes, role changes, exports, Reveal views and permission withdrawals. Nobody inside the product, not even an administrator, can change or remove entries. The audit log's integrity can be verified: Verify integrity checks that no entry has been changed or is missing. You can export it to CSV.

Three roles, assigned on the product's Users page; the roles are Microsoft Entra application roles:

• Admin: everything, including security settings and roles.
• Security Manager: runs scans and actions and edits rules, but cannot change security settings or roles.
• Reporter: read-only access to history, results, the audit log and exports, and can run Safe Scan. Suited to the people who need to see the results for the purpose, for example your KVKK officer; limit access to the results to the fewest people necessary.

Assigning a role needs a Microsoft Entra role that can assign application roles (for example Global or Cloud Application Administrator).

The product runs as an Azure Managed Application in your own Azure subscription. Scan results, logs, the audit log and configuration stay in your own Azure storage. You do not need E5, an extra Microsoft licence tier or a paid Microsoft API.

Yes, and we say so plainly. As with every Azure Managed Application, Inthouse has management access to the resources deployed for the application in your subscription. Inthouse does not access your content: scan results, logs and configuration stay in your own Azure storage. Our technical team walks you through the details.

Our technical team answers this for your deployment. Ask when you request a demo.

Yes, our technical team handles security questionnaires and vendor assessments. Ask our sales team to put you in touch.

Through Azure Marketplace, where the product is listed as Compliance Agent for Microsoft 365. There are two plans: Compliance Agent Suite, one seat pool across the Exchange, OneDrive, Teams and DiskScanner scan areas, and Pay-per-Agent, where seats are counted and billed per scan area. Billed by Microsoft through your Azure billing account. The Azure infrastructure costs of the deployed resources are billed separately by Microsoft. Prices are given in a separate quote. See the pricing model.

A mailbox or account becomes a seat the first time the product scans it and keeps counting while it stays in scope; re-scanning costs nothing extra. In the Suite plan a person in scope of more than one area counts as one seat. Overage is off by default: at your seat limit, new users are refused until you add seats, unless you turn overage on.

Yes: 5 users, 15 days. Request a demo; if you wish, we plan the free trial in the same session. We invite you to a private trial plan on Azure Marketplace; you deploy it from there in about 10 minutes and your Global Administrator completes the one-time setup step. We recommend starting with a Safe Scan, which touches nothing.

Please ask our sales team. They will explain how the trial ends and how to move to a paid plan.

It deploys from Azure Marketplace in about 10 minutes, followed by your Global Administrator's one-time setup step. You need:

• an Azure subscription to deploy into;
• a Global Administrator for the one-time setup step;
• each scanned employee's own permission, in every area including Exchange, OneDrive and Teams (see FAQ 21);
• access to your on-premises systems for on-premises Exchange Server and DiskScanner.

You do not need E5, an extra Microsoft licence tier or a paid Microsoft API.

No scan can run without the employee's permission; this applies in every area, including Exchange, OneDrive and Teams. Each employee gives permission through a personal link your organisation sends, carrying your logo and your text, in Turkish or English. You can see who has given permission, who is pending and whose permission is about to expire, and resend in one step. Only the data of employees who gave permission is in scope. Permission lapses after 90 days without use; the employee then has to give it again. This permission does not replace your duty to inform employees and is not a legal ground; you prepare your notice and your permission mechanism for your own organisation, and you decide with your legal adviser which legal ground you rely on. See KVKK and the Board's principle decision. This is not legal advice; consult your own legal advisers.

No tool can do that on its own. Compliance Agent helps you verify adherence to your organisation's policies and show what you did. How the law and the Board's principle decision apply to you is a matter for your own legal advisers.

Principle decision 2026/2035 of the Personal Data Protection Board (Official Gazette 8 October 2026, no. 33394) set out how employers may access corporate e-mail accounts and other work-related communication channels. Every scan of employee communications falls under the decision: a concrete notice in advance, business and private use kept apart, gradual auditing (content access as the last resort), limited access and records. Before scanning, assess with your legal advisers how this fits your notices and policies; see KVKK and the Board's principle decision.

Correspondence also contains personal data of third parties, for example senders outside the organisation; the employee's permission does not cover them. Narrow the scope with user group, date range and rule selection. The product is for verifying adherence to your organisation's policies; it is not designed to look into a particular employee. We share a short "before you scan" list. This is not legal advice; consult your own legal advisers.

Our sales team will tell you about support and how to remove the product. Ask when you request a demo.