Data Handling
What 1Security reads, what it actually stores, where it runs, how long data is kept, and what happens when you disconnect - the answers a security review asks for.
Data Handling
1Security reads a lot about your tenant, which makes "what happens to it?" a fair question - and usually the first one a security review asks. This page answers it in the order those reviews tend to go.
What is read, and what is stored
The distinction matters more than the volume. Most of what 1Security touches is read, evaluated and discarded; what persists is the map, not the material.
| Data | Read | Stored |
|---|---|---|
| Identities, groups, roles, devices, apps, agents | Yes | Yes - metadata only (names, IDs, membership, timestamps, licence assignment) |
| Sites, files, folders, links | Yes | Yes - metadata and permissions: path, owner, sharing state, who can reach it |
| File content | Yes, during a sensitivity scan | No. Content is streamed into the analysis process and discarded when it finishes |
| Email content | Yes, when the Email module is enabled | No. Bodies and attachments are analysed in the same transient way |
| Sensitivity findings | - | The detection type, the match count and a confidence bucket, linked to the file. The matched values themselves are not written to the database |
| Activity (unified audit log) | Yes | Yes - actor, action, resource, app, device, location, timestamp |
The practical summary customers care about: 1Security never becomes a second copy of your documents or your mailboxes. It becomes a copy of who can reach them and what was done with them.
How sensitivity scanning analyses content
The sensitivity engine runs in your deployment's own process:
- Detectors are deterministic - over 300 regular-expression and keyword detectors, plus validation rules such as checksum tests on card and identifier formats.
- OCR runs locally - images and scanned documents are processed offline inside the same process, not sent anywhere.
- No third-party AI service sees file content in the default configuration. Optional LLM-assisted analysis exists for harder cases, is gated per tenant, and falls back to the deterministic detectors whenever AI is disabled for the tenant.
Where the data lives
| Model | Where processing and storage happen | Fits when |
|---|---|---|
| Cloud (SaaS) | 1Security's managed environment | You want zero infrastructure. Setup is minutes. |
| BYOC (Azure) | Your own Azure subscription, using our container images | Data residency rules require the data to stay in your cloud |
| On-Premise | Your own hardware, air-gapped if needed | Full control of location and network boundaries |
Deployment specifics, sizing and cost estimates are in Installation.
Tenant isolation
Every connected tenant gets its own dedicated database, not a shared table with a tenant column. A query issued for one tenant physically cannot reach another tenant's rows. On top of that, every tenant-scoped table carries the tenant identifier and every query filters on it - the isolation is enforced twice, at the infrastructure layer and in the query layer.
This is also what makes multi-tenant scenarios safe for MSPs and holding companies: connecting a second tenant adds a database, it does not widen the blast radius of the first.
Access inside 1Security
Reading your tenant is one permission question; who inside your organisation can read it in 1Security is another. Three access levels are available when inviting a user:
- Sync with Microsoft 365 - admin status follows the person's existing Entra roles.
- Admin - full access to all resources, settings and connected tenants.
- User (limited access) - sees only their own resources: files, emails, groups and sites they own or interact with, plus trends explicitly shared with them.
Before inviting a limited user you can preview exactly what they will see. Details in Getting Started.
Write access
The base installation cannot change anything in your tenant. Write permission exists in exactly two opt-in modules - Automations and Mailbox Management - and even once enabled:
- Actions are staged behind a review queue with a grace period before anything executes.
- Every action is recorded in a ledger you can replay - what was proposed, who approved it, what actually changed.
- Mailbox actions quarantine or flag; they do not permanently delete.
The exact permission each module requests is listed in Requirements.
Retention
- Activity history is retained for as long as your subscription is active, up to three years. Three years of continuous subscription means three years of history available for investigation - far past Microsoft's default audit retention.
- Sensitivity findings and the permission graph reflect the current state of the tenant and are refreshed by scans; historical trend points are kept so you can see direction of travel.
Disconnecting and deletion
Disconnect a tenant from Settings → Tenants → Disconnect. All data associated with that tenant is removed from 1Security within 7 days.
Because each tenant has its own database, disconnection removes that database rather than filtering rows out of a shared one - there is no residue in another customer's dataset.
Revoking consent in Microsoft Entra also cuts access immediately, independently of anything done in 1Security: the application's tokens stop working the moment consent is withdrawn.
Disconnecting is not the same as pausing. Once the deletion completes, the activity history built up under that tenant is gone - reconnecting starts the three-year window again from the data Microsoft still holds, which is usually 90 days.
Frequently asked in security reviews
Integrations & Modules
Expand 1Security's capabilities through modular integrations while maintaining the principle of least privilege.
Permission Graph
One interactive map of every identity, resource, and permission in your tenant - so "why does this user have access to this file?" becomes a path you can see, not a project.