Security and data

Your data stays in your Azure

The product runs as an Azure Managed Application in your own Azure subscription. Scan results, logs, the audit log and configuration stay in your own Azure storage. You do not need E5, an extra Microsoft licence tier or a paid Microsoft API.

Management access

Yes, and we say so plainly. As with every Azure Managed Application, Inthouse has management access to the resources deployed for the application in your subscription. Inthouse does not access your content: scan results, logs and configuration stay in your own Azure storage. Our technical team walks you through the details.

Our technical team also handles security questionnaires and vendor assessments.

What you need

• an Azure subscription to deploy into;
• a Global Administrator for the one-time setup step;
• each employee’s own permission for every scanned employee (across Exchange, OneDrive and Teams);
• access to your on-premises systems for on-premises Exchange Server and DiskScanner.

It deploys from Azure Marketplace in about 10 minutes, followed by your Global Administrator’s one-time setup step.

Who can do what?

Three roles, assigned on the product’s Users page; the roles are Microsoft Entra application roles:

• Admin: everything, including security settings and roles.
• Security Manager: runs scans and actions and edits rules, but cannot change security settings or roles.
• Reporter: read-only access to history, results, the audit log and exports, and can run Safe Scan. Suited to the people who need to see the results for the purpose, for example your KVKK officer; limit access to the results to the fewest people necessary.

Assigning a role needs a Microsoft Entra role that can assign application roles (for example Global or Cloud Application Administrator).

Employee permission

No scan can run without the employee’s permission. Each employee gives permission through a personal link your organisation sends, carrying your logo and your text, in Turkish or English. You can see who has given permission, who is pending and whose permission is about to expire, and resend in one step. Permission lapses after 90 days without use and must be given again. This permission does not replace your duty to inform employees and is not a legal ground; see KVKK and the Board’s principle decision.

Action is controlled

• Action modes stay off until an administrator turns them on; on a new installation only Safe Scan is possible.
• Safe Scan scans and reports only; it touches nothing.
• You set a hard action limit for each scan area: the number of items processed in one run. A run that would exceed the limit stops. There is no button to override the limit; raising it is an administrator step and is recorded.
• If the audit log cannot be written, the action is refused.
• Before an action, a copy of each OneDrive file is placed in your own Azure storage; if the copy cannot be made, no action is applied to that file.
• In Exchange, OneDrive and Teams an action cannot be reversed.

A record of every step

Every administrative step: configuration changes, scans, actions, limit changes, role changes, exports, Reveal views and permission withdrawals. Nobody inside the product, not even an administrator, can change or remove entries. The audit log’s integrity can be verified: Verify integrity checks that no entry has been changed or is missing. You can export it to CSV.

What do the results contain?

The results show the rule that matched; the value found is not recorded. To see the full content, Reveal asks for a duration, a reason and a request number; every view is written to the audit log. Access to the results depends on the roles you assign; we recommend limiting it to the fewest people necessary for the purpose.

Before you scan

Before you scan: what your organisation should have in place. The headings below summarise the principles of the Board’s principle decision 2026/2035; this is not legal advice; consult your own legal advisers.

1. A concrete notice. To employees, before scanning, through a channel that reaches them and in a notice specific to this processing: the legal ground and purpose, that the audit is a content audit, the cases in which content will be accessed, the scope (which channels, which user groups, which date range), the method, the announced periods in which scans run, how long the results are kept, who sees them and the data subject’s rights. A general statement that e-mail may be checked, or a general undertaking, is not enough. The employee permission in the product does not replace this notice and is not a legal ground; which legal ground you rely on is decided with your legal adviser.

2. A written policy on business and private use. Whether corporate e-mail, Teams and OneDrive may be used for private purposes and, if so, on what conditions; decided in advance, announced to employees, and clear enough to prevent an unjustified expectation of privacy. Limit scanning to corporate, business channels only.

3. The need to access content. The product’s rules work by reading content. First assess whether the purpose can be reached without reading content, for example through traffic data, records or preventive technical measures; use content scanning only to the extent those routes are insufficient and within the scope the purpose requires. Whether a content scan is necessary and proportionate is your organisation’s assessment.

4. Not aimed at a particular employee. The product is for verifying adherence to your organisation’s policies; it is not designed to look into a particular employee. The decision limits content review to cases of concrete suspicion and to the allegation; a suspicion about, a complaint about, or a disciplinary case involving an employee needs a separate legal assessment and is not what this product is for.

5. Limited scope, limited access, records. Which user groups, which date range, which rules. Leave private correspondence and sensitive personal data out of scope unless their review is unavoidable; keep in mind the data of third parties in correspondence. Decide, limited to the purpose and with the fewest people possible, who may see the results and who may take an action, assign the product’s roles accordingly, and keep the audit log. Also review internal measures such as closing leavers’ accounts promptly and keeping data that must be retained closed to access. Start with Safe Scan, which touches nothing.

   Data you are legally required to keep. Identify the data your organisation must keep under a statutory retention duty (for example commercial books and records, personnel and payroll files, tax records). Using the product’s scope settings (user group and account selection, date range, rule selection), keep the mailboxes and accounts that hold such data out of every action scope, and keep that data closed to access. The product does not exclude by folder; if such data sits inside a mailbox, do not put that mailbox in an action scope. The product has no legal hold feature; exclusion is done through scope settings.

6. Your own legal adviser’s opinion before the first scan; and a technical expert’s opinion if anything is uncertain during setup.