---
title: Data Handling
description: What 1Security reads, what it actually stores, where it runs, how long data is kept, and what happens when you disconnect - the answers a security review asks for.
icon: ShieldCheck
---

# Data Handling

1Security reads a lot about your tenant, which makes "what happens to it?" a fair question - and usually the first one a security review asks. This page answers it in the order those reviews tend to go.

## What is read, and what is stored

The distinction matters more than the volume. Most of what 1Security touches is read, evaluated and discarded; what persists is the map, not the material.

| Data | Read | Stored |
| :--- | :--- | :--- |
| Identities, groups, roles, devices, apps, agents | Yes | Yes - metadata only (names, IDs, membership, timestamps, licence assignment) |
| Sites, files, folders, links | Yes | Yes - **metadata and permissions**: path, owner, sharing state, who can reach it |
| **File content** | Yes, during a sensitivity scan | **No.** Content is streamed into the analysis process and discarded when it finishes |
| **Email content** | Yes, when the Email module is enabled | **No.** Bodies and attachments are analysed in the same transient way |
| Sensitivity findings | - | The detection **type**, the match count and a confidence bucket, linked to the file. The matched values themselves are not written to the database |
| Activity (unified audit log) | Yes | Yes - actor, action, resource, app, device, location, timestamp |

<Callout type="info">
  The practical summary customers care about: 1Security never becomes a second
  copy of your documents or your mailboxes. It becomes a copy of who can reach
  them and what was done with them.
</Callout>

## How sensitivity scanning analyses content

The [sensitivity engine](/en/docs/sensitivity) runs **in your deployment's own process**:

- **Detectors are deterministic** - over 300 regular-expression and keyword detectors, plus validation rules such as checksum tests on card and identifier formats.
- **OCR runs locally** - images and scanned documents are processed offline inside the same process, not sent anywhere.
- **No third-party AI service sees file content** in the default configuration. Optional LLM-assisted analysis exists for harder cases, is gated per tenant, and falls back to the deterministic detectors whenever AI is disabled for the tenant.

## Where the data lives

| Model | Where processing and storage happen | Fits when |
| :--- | :--- | :--- |
| **Cloud (SaaS)** | 1Security's managed environment | You want zero infrastructure. Setup is minutes. |
| **BYOC (Azure)** | Your own Azure subscription, using our container images | Data residency rules require the data to stay in your cloud |
| **On-Premise** | Your own hardware, air-gapped if needed | Full control of location and network boundaries |

Deployment specifics, sizing and cost estimates are in [Installation](/en/docs/installation).

### Tenant isolation

Every connected tenant gets its **own dedicated database**, not a shared table with a tenant column. A query issued for one tenant physically cannot reach another tenant's rows. On top of that, every tenant-scoped table carries the tenant identifier and every query filters on it - the isolation is enforced twice, at the infrastructure layer and in the query layer.

This is also what makes multi-tenant scenarios safe for MSPs and holding companies: connecting a second tenant adds a database, it does not widen the blast radius of the first.

## Access inside 1Security

Reading your tenant is one permission question; who inside your organisation can read it in 1Security is another. Three access levels are available when inviting a user:

- **Sync with Microsoft 365** - admin status follows the person's existing Entra roles.
- **Admin** - full access to all resources, settings and connected tenants.
- **User (limited access)** - sees only their own resources: files, emails, groups and sites they own or interact with, plus trends explicitly shared with them.

Before inviting a limited user you can preview exactly what they will see. Details in [Getting Started](/en/docs/getting-started#managing-accounts-and-access).

## Write access

The base installation cannot change anything in your tenant. Write permission exists in exactly two opt-in modules - [Automations](/en/docs/screens/automations) and Mailbox Management - and even once enabled:

- Actions are **staged behind a review queue** with a grace period before anything executes.
- Every action is recorded in a ledger you can replay - what was proposed, who approved it, what actually changed.
- Mailbox actions quarantine or flag; they do not permanently delete.

The exact permission each module requests is listed in [Requirements](/en/docs/requirements#permissions-module-by-module).

## Retention

- **Activity history** is retained for as long as your subscription is active, up to **three years**. Three years of continuous subscription means three years of history available for investigation - far past Microsoft's default audit retention.
- **Sensitivity findings and the permission graph** reflect the current state of the tenant and are refreshed by [scans](/en/docs/scans); historical trend points are kept so you can see direction of travel.

## Disconnecting and deletion

Disconnect a tenant from **Settings → Tenants → Disconnect**. All data associated with that tenant is removed from 1Security **within 7 days**.

Because each tenant has its own database, disconnection removes that database rather than filtering rows out of a shared one - there is no residue in another customer's dataset.

Revoking consent in Microsoft Entra also cuts access immediately, independently of anything done in 1Security: the application's tokens stop working the moment consent is withdrawn.

<Callout type="warn">
  Disconnecting is not the same as pausing. Once the deletion completes, the
  activity history built up under that tenant is gone - reconnecting starts the
  three-year window again from the data Microsoft still holds, which is usually
  90 days.
</Callout>

## Frequently asked in security reviews

<Accordions>
  <Accordion title="Do you store our files?">
    No. File and email content is read during analysis and discarded when the
    analysis finishes. What persists is metadata, permissions, and the type and
    count of any sensitive information detected.
  </Accordion>
  <Accordion title="Is our content sent to an AI provider?">
    Not in the default configuration. Detection is deterministic - regular
    expressions, keyword rules and validation checks - and OCR runs locally.
    Optional LLM-assisted analysis is gated per tenant and falls back to the
    deterministic detectors when AI is disabled.
  </Accordion>
  <Accordion title="Can 1Security change anything in our tenant?">
    Not unless you enable Automations or Mailbox Management. The base
    installation holds read permissions, with the one documented exception of
    SharePoint's `Sites.FullControl.All` scope, which SharePoint's own API
    requires to expose sharing configuration - see
    [Requirements](/en/docs/requirements#core-visibility---read-only-granted-at-install).
  </Accordion>
  <Accordion title="Can we keep all data inside our own cloud?">
    Yes - the BYOC model runs the whole platform in your Azure subscription, and
    the On-Premise model runs it on your own hardware, air-gapped if required.
  </Accordion>
  <Accordion title="What happens to our data if we stop being a customer?">
    Disconnect the tenant and everything associated with it is deleted within 7
    days. Revoking application consent in Entra cuts access immediately in the
    meantime.
  </Accordion>
</Accordions>