Frequently asked questions

It's a personal-data discovery and clean-up tool. It finds personal data your organisation no longer needs in Exchange Online mail, OneDrive files and Teams one-to-one chats (for employees who have opted in), and helps your team delete it under safeguards you set, with every administrative action recorded.

• Exchange Online: every mailbox folder, including nested folders, by subject and message body. Attachments and online archive mailboxes are not scanned.
• OneDrive: Word, Excel, PowerPoint, PDF, CSV and plain-text files. Images and scanned documents are not read. Files shared outside your organisation are flagged next to the findings.
• Microsoft Teams: one-to-one chats, for employees who have opted in. Only the messages they sent are in scope; those messages may also contain personal data about the other person in the chat.

Seven ready-made rules: Turkish national ID (TCKN), Turkish IBAN, IBAN from any country, payment card number, Turkish phone number, email address and passport number. The national ID, IBAN and card rules are checked by checksum, not just by pattern. You can also add your own keywords and patterns, for example for local identifiers.

Is there a difference between the ready-made rules and our own keywords? Yes. The ready-made rule packs are built for the product's purpose: finding personal data such as IBANs and national ID numbers, to help you meet your KVKK/GDPR obligations. Your own keywords and patterns are your choice: whether they are appropriate is entirely your own evaluation and responsibility.

No. You switch the ready-made rules on, rule by rule, and you can test them on sample text before you scan.

It records which rule matched, not the number it found. Results still show message subjects, file names and sender addresses, so that a reviewer can decide what to do. Viewing them is a review of content. Access to results depends on the roles you assign; we recommend limiting it to the fewest people whose purpose needs it.

Can we hide content in the results? Not today. In every mode, Safe Scan included, results record subjects, file names and senders, and the Selective Deletion review shows them. A results view that hides content, with a recorded switch to reveal all or part of a finding when needed, is Coming soon.

Deletion is switched off until an administrator turns it on. You can always start with Safe Scan, which finds and reports and deletes nothing. Selective Deletion lets a person review the findings and delete only what they tick. Direct Deletion finds and deletes in one run, for when you're confident in the rules; it doesn't put items to a person one by one.

You set a hard deletion limit for each agent. If a run would delete more than the limit, it stops. There's no override button: an administrator has to raise the limit, and that change is logged. In Direct Deletion, items deleted before the limit was reached stay deleted. Also, if the audit log can't be written, the deletion is refused.

No. The product has no feature that reverses a deletion. Deletion is deliberate, which is why it's gated by modes, limits, roles and the audit log. In Exchange and OneDrive, deletion is permanent; Teams messages are deleted with Microsoft's soft delete. Before a OneDrive file is deleted, it's backed up to your own Azure storage and kept for 90 days by default; if the backup fails, that file isn't deleted. To get a backed-up file back, you copy it from your own storage; keep access to those backups limited too. Exchange mail has no backup. How your Microsoft 365 retention policies or holds interact with deletions is a question for our technical team.

Can the product delete data we are legally required to keep? Yes, if that data is in scope. So leave the mailboxes and accounts that hold data you must keep out of scope. The product has no legal hold feature today; protecting named people from any deletion is Coming soon.

For Exchange Online, yes: for a defined purpose, you can schedule periodic clean-up on the cycle your retention policy sets, using your own keywords and patterns, within your deletion limit. Scans run at foreseeable periods that your employee notice and your destruction policy set out and announce in advance. They are never secret or unannounced, never run without a break, and never process each message as it arrives (as mail forwarding or DLP-style tools do). Announce manual, on-demand scans in advance too. The ready-made rules work in on-demand scans; in scheduled scans, whether your own keywords and patterns are appropriate is your own evaluation. Coming soon: scheduled scans with the KVKK/GDPR rule packs, and scheduled OneDrive scans.

Every administrative action: configuration changes, scans, deletions, limit changes, role changes, exports and opt-in removals. Nobody, not even an administrator, can edit or delete entries from inside the product. The log is tamper-evident: Verify integrity checks that nothing has been edited or removed. You can export it to CSV.

Three roles, assigned from the product's Users page:

• Admin: everything, including safety settings and roles.
• Security Manager: runs scans and deletions and edits detection rules, but can't change safety settings or roles.
• Reporter: read-only access to history, results, the audit log and exports, and may run Safe Scan. A good fit for people whose purpose needs the results, such as your DPO or auditor; results show subjects, file names and senders from employees' communications, so keep this role narrow.

Assigning roles needs a Microsoft Entra role that can assign app roles, such as Global or Cloud Application Administrator.

The product runs in your own Azure subscription. Scan results, logs, the audit trail and configuration stay in your own Azure storage.

Yes, and we're open about it. As with any Azure Managed Application, inthouse has management access to the resources deployed for the app in your subscription. inthouse does not access your content: scan results, logs and configuration stay in your own Azure storage. For detail, our technical team will walk you through it.

Our technical team answers this for your deployment. Ask when you request a demo.

Yes, our technical team handles security questionnaires and vendor assessments. Ask our sales team to put you in touch.

On Azure Marketplace, as "Compliance Manager for Microsoft 365". It's billed by Microsoft through your Azure billing account, and Azure infrastructure costs for the deployed resources are billed separately by Microsoft. Prices come in a separate quote: our sales team can walk you through the plans. Pricing explains how the model works.

A seat is a mailbox or person the product has scanned. Our sales team can go through how seats are counted for your numbers, and Pricing explains the model.

Yes. Request a free trial from our sales team: 5 users for 15 days, with the Exchange Online, OneDrive and Teams agents. We'll invite you to a private trial plan on Azure Marketplace; you deploy it from there in about 10 minutes, and your Global Administrator does the one-time setup step. We recommend starting with a Safe Scan, which deletes nothing.

Please ask our sales team. They will explain how the trial ends and how it moves to a paid plan.

It deploys from Azure Marketplace in about 10 minutes, followed by a one-time setup step by your Global Administrator. You need:

• the mailboxes, OneDrive accounts and Teams chats you want to scan, already in Microsoft 365;
• an Azure subscription to install into;
• a Global Administrator for the one-time setup step;
• for Teams, each employee's own opt-in (see question 21).

You don't need E5 or any extra Microsoft licence tier or paid Microsoft API.

Each employee opts in personally, from a branded email you send, in English or Turkish, with your logo and wording. You can see who has opted in, who is pending and whose opt-in is about to expire, and resend with one click. Only one-to-one chats of employees who have opted in are in scope, and only the messages they sent. The opt-in lets the product act on that employee's chats; it doesn't replace your duty to inform employees, and it lapses after 90 days without use, after which the employee needs to opt in again.

KVKK: As your legal counsel will advise, employees must be informed in advance and their consent obtained before scanning. For Teams, that consent is given through this opt-in, which each employee completes personally after being informed. For Exchange Online and OneDrive, the product has no consent step: you obtain and record consent through your own process; the product doesn't store or verify it. It is not legal advice; please consult your own counsel.

GDPR: The opt-in is a technical step; how you meet your GDPR obligations towards employees is a question for your own counsel.

No tool can do that on its own. inthouse Compliance Manager helps you meet your KVKK and GDPR obligations to keep personal data only as long as you need it, and to show what you did. How the law applies to you is a question for your own legal advisers.

KVKK: In 2026 the KVKK Board published a principle decision on how employers may access corporate email and other work communication channels. Before scanning employee mailboxes, check with your legal advisers how this fits your employee notices and policies. As your legal counsel will advise, employees must be informed in advance and their consent obtained before scanning (for Teams through the opt-in; for Exchange Online and OneDrive through your own process, see question 21). Keep the scan to corporate, business-use channels, in periods announced in advance. Any scan, review of findings or deletion aimed at a particular employee, or outside the announced periodic clean-up, should take place only where there is strong evidence.

GDPR: Scanning employee mail needs care under the GDPR and local employment law. Before scanning, check with your legal advisers, including on your transparency notice to employees and whether a data protection impact assessment is needed.

Both: the product is built to find and destroy personal data you no longer need, not to look into a particular employee. Our "before you scan" checklist sets out what your organisation should have in place. It is not legal advice; please consult your own counsel.

Our sales team can tell you about support and about removing the product. Ask when you request a demo.