Security and data | Compliance Manager

Your data stays in your Azure

The product runs in your own Azure subscription. Scan results, logs, the audit trail and configuration stay in your own Azure storage. You do not need an extra Microsoft licence tier: no E5, no add-on, and no paid Microsoft API.

Management access, stated plainly

As with any Azure Managed Application, inthouse has management access to the resources deployed for the app in your subscription. inthouse does not access your content: scan results, logs and configuration stay in your own Azure storage.

If you need more detail, for example what the product connects to or how it signs in, our technical team will walk you through it. They also handle security questionnaires and vendor assessments.

What you need

The mailboxes, OneDrive accounts and Teams chats you want to scan, already in Microsoft 365.
An Azure subscription to install into. The Azure resources it runs on are billed separately by Microsoft.
A Global Administrator for one setup step, to approve the permissions.
For Teams, each employee’s own opt-in.
An Entra role that can assign app roles, such as Global or Cloud Application Administrator, to assign the product’s roles.

It deploys in about 10 minutes, followed by the one-time Global Administrator setup step.

Who can do what

Three roles, assigned from the Users page.

Admin: everything, including safety settings and roles.
Security Manager: runs scans and deletions and edits detection rules, but cannot change safety settings or roles.
Reporter: read-only access to history, results, the audit log and exports, and may run a Safe Scan. Give it only to people whose purpose needs the results, such as your DPO or auditor.

Deletion is gated

Deletion is switched off until an administrator turns it on.
Safe Scan finds and reports and deletes nothing.
A hard deletion limit per agent stops a run that would go over it. There is no override button.
If the audit log cannot be written, the deletion is refused.
OneDrive files are backed up to your own Azure storage before deletion. If the backup fails, that file is not deleted.
In Exchange and OneDrive, deletion is permanent. Teams messages are deleted with Microsoft’s soft delete.

A record of every action

Every administrative action goes into the audit log: configuration changes, scans, deletions, limit changes, role changes, exports and opt-in removals. Nobody, not even an administrator, can edit or delete entries from inside the product. The log is tamper-evident, and Verify integrity checks that nothing has been edited or removed. You can export it to CSV.

What results contain

The product records which rule matched, not the number it found. Results still show message subjects, file names and sender addresses, so that a reviewer can decide what to do. Viewing them is a review of content, so keep access to the fewest people whose purpose needs it. A results view that hides content is Coming soon.

Before you scan

Scanning employees’ mail, files and chats needs preparation. This is what your organisation should have in place first. It is not legal advice: please consult your own legal counsel.

KVKK edition: six things to have in place

Employee notice, and employees’ consent obtained. As your legal counsel will advise, employees must be informed in advance and their consent obtained before scanning. The notice: a specific notice, given in advance in clear and plain language through a channel that reaches employees, that work email, OneDrive and Teams may be scanned for personal data you no longer need: purpose, scope, method, legal basis and the legislation it rests on, the foreseeable periods, announced in advance, in which scans will run, what the scan leads to, how long results are kept, the recipients (who sees the results), and employees’ rights. A general statement that email may be checked, or a general signed undertaking, is unlikely to be enough. Scans run in those periods; they are never secret or unannounced, never run without a break, and never process each message as it arrives (as mail forwarding or DLP-style tools do). Announce manual, on-demand scans in advance too. Consent: for Teams, it is given through each employee’s personal opt-in, from the invitation email, after they have been informed; the opt-in doesn’t replace the notice, lapses after 90 days without use, and must then be given again. For Exchange Online and OneDrive, you obtain and record consent through your own process; the product doesn’t store or verify it.
Business channels only, and a written policy on private use. Scan only corporate, business-use communication channels; personal or private channels and private-use correspondence stay out. Decide whether work email, Teams and OneDrive may be used privately and, if so, on what terms; set in advance, made known to employees, and clear enough that no unjustified expectation of privacy arises.
A defined purpose, and whether content needs to be scanned. For example: destroying personal data that your retention and destruction policy no longer allows you to keep. The product’s rules work by reading content. So first consider whether the purpose can be met without reading content, for example by deleting by retention period or through records; use content scanning only where those routes aren’t enough and as far as the purpose requires, with the built-in rule packs. Your own keywords and patterns are entirely your own evaluation and responsibility.
Not aimed at an individual without strong evidence. Routine clean-up runs in the announced periods, with employees informed and their consent obtained. Any scan, review of findings or deletion aimed at a particular employee, or outside the announced periodic clean-up, should take place only where there is strong evidence, and needs a separate legal assessment. Don’t use the routine clean-up for a suspicion about, a complaint about, or a disciplinary case involving an employee. Viewing findings (subjects, file names, senders) is a review of content.
A limited scope and limited access: which mailboxes and accounts, which date range, which data categories. Keep the scope to corporate, business-use channels and to work communication. The product can’t separate work from private correspondence inside a mailbox: you set the scope by mailbox, date range and rule. Where that separation can’t be made, keep the scope narrower. Leave private correspondence and special-category personal data (such as health data) out of scope unless they must be reviewed. Because viewing findings is a review of content, decide, limited to the purpose and to the fewest people, who may see results and who may delete, assign the product’s roles accordingly, and keep the audit log. Also review your own measures, such as closing leavers’ accounts at once and keeping data you must retain access-closed. Start with Safe Scan, which deletes nothing.

Data you must keep by law. Identify the data your organisation must keep under a statutory retention obligation (for example commercial books and records, HR and payroll files, tax records). Leave the mailboxes and accounts that hold it out of any deletion scope, using the product’s scope settings (mailbox and account selection, date range, rule selection), and keep that data access-closed. The product can’t exclude individual folders; if such data sits inside a mailbox, keep that mailbox out of deletion scope. The product has no legal hold feature today; exclusion is done by scope.
Your own legal counsel’s view, including on how consent is obtained, before the first scan; and a technical expert’s view where technical points are unclear during set-up.

GDPR edition: seven things to have in place

A transparency notice to employees (GDPR Art. 13), given in advance in clear and plain language, that work email, OneDrive and Teams may be scanned for personal data you no longer need: purpose, scope, method, legal basis, the foreseeable periods, announced in advance, in which scans will run, what the scan leads to, how long results are kept, the recipients (who sees the results), and employees’ rights. A general statement that email may be checked is unlikely to be enough.
Business channels only, and a written policy on private use. Scan only corporate, business-use communication channels; personal or private channels and private-use correspondence stay out. Decide whether work email, Teams and OneDrive may be used privately and, if so, on what terms; set in advance, made known to employees, and clear enough that no unjustified expectation of privacy arises.
A defined purpose, and whether content needs to be scanned. For example: deleting personal data that your retention policy no longer requires you to keep. The product’s rules work by reading content. So first consider whether the purpose can be met without reading content, for example by deleting by retention period or through records; use content scanning only where those routes aren’t enough and as far as the purpose requires, with the built-in rule packs. Your own keywords and patterns are entirely your own evaluation and responsibility.
Not aimed at an individual without strong evidence. Routine clean-up runs in the announced periods, with employees informed. Any scan, review of findings or deletion aimed at a particular employee, or outside the announced periodic clean-up, should take place only where there is strong evidence, and needs a separate legal assessment. Don’t use the routine clean-up for a suspicion about, a complaint about, or a disciplinary case involving an employee. Viewing findings (subjects, file names, senders) is a review of content.
A limited scope and limited access: which mailboxes and accounts, which date range, which data categories. Keep the scope to corporate, business-use channels and to work communication. The product can’t separate work from private correspondence inside a mailbox: you set the scope by mailbox, date range and rule. Where that separation can’t be made, keep the scope narrower. Leave private correspondence and special-category personal data (such as health data) out of scope unless they must be reviewed. Because viewing findings is a review of content, decide, limited to the purpose and to the fewest people, who may see results and who may delete, assign the product’s roles accordingly, and keep the audit log. Also review your own measures, such as closing leavers’ accounts at once and keeping data you must retain access-closed. Start with Safe Scan, which deletes nothing.

Data you must keep by law. Identify the data your organisation must keep to comply with a legal obligation under Union or Member State law (the right to erasure does not apply to it, GDPR Art. 17(3)(b)), for example accounting, HR and payroll, and tax records. Leave the mailboxes and accounts that hold it out of any deletion scope, using the product’s scope settings (mailbox and account selection, date range, rule selection), and keep that data access-closed. The product can’t exclude individual folders; if such data sits inside a mailbox, keep that mailbox out of deletion scope. The product has no legal hold feature today; exclusion is done by scope.
Your own legal counsel’s view, including on the legal basis, before the first scan; and a technical expert’s view where technical points are unclear during set-up.
Ask your counsel whether a data protection impact assessment is needed, and whether local employment law or employee representatives must be involved.