Data privacy

Rencore Governance stores customer data encrypted in the datacenter chosen for the Workspace, follows GDPR, and deletes the data 60 days after a subscription expires.

Does Rencore Governance use AI features?

No. Rencore Governance does not use AI features to deliver its own functionality. It governs AI services such as Microsoft 365 Copilot, but no AI model inside the product processes your data.

Where can I find additional data privacy information for Rencore Governance?

• Rencore’s privacy notice, with regard to instances in which Rencore is acting as a data controller: https://rencore.com/en/privacy-notice/
• A Data Processing Agreement can be concluded, or in some cases is automatically incorporated, on signing a contract for Rencore Governance

Please provide information on where or at which datacenter customer data will reside.

Data is stored in Azure Storage Accounts in one of the available datacenters that are specified during the configuration of a Workspace.

If your system or application contains sensitive data at rest, does the system encrypt this data, and how?

Yes. All information is encrypted.

Azure Storage Accounts and PostgreSQL have built-in support for encryption at rest and in transit.

If your system is designed to process, store, or transmit privacy data, is it compliant with the EU General Data Protection Regulation?

Yes. We are GDPR compliant and take all the measures required to maintain such compliance on a continual basis.

How do you keep the stored customer data GDPR compliant?

We store URLs, titles, and other metadata of the collected data, like Site Collections, Sites, Lists, Teams, etc. The collected customer data can be removed at any time by removing the encrypted storage tables belonging to the customer.

Any PII (personally identifiable information) is also encrypted.

Customers can make a request to our support to have all their data deleted, subject to a 30-day retention period for the deletion of Workspaces, to protect them against accidental deletion, and subject to a longer retention period for some historic non-personal data.

When a customer terminates its business arrangements with you, how long after the termination do you hold or keep customer data before it is completely purged?

When a subscription ends, Rencore archives the workspace data for 30 days and then queues it for deletion for another 30 days. The data is permanently deleted 60 days after the subscription expires.

Customers can also delete a Workspace themselves in the Rencore Governance portal, which immediately (within a maximum of 10 minutes) puts the data into purge mode. Rencore support can restore this data on request; after 30 days the data is permanently deleted.

What data leaves the client, and when?

Depending on the configured inventories and policies in Rencore Governance, during the scan of a Microsoft 365 tenant, we collect instance information about site collections and child elements (sites, lists, files, customizations), Teams teams, M365 groups, etc. This data is validated by our compliance policy engine and we store information about violated policies in our backend.

Is data leaving the client in an encrypted state?

Yes. We use all the built-in capabilities of encryption in transit (TLS 1.3) and encryption at rest (Azure Storage and PostgreSQL encryption).

How do you make sure that third parties, including Rencore, cannot access data leaving the customer?

Limited staff at Rencore have access to our cloud environments in production, as determined by the System Access Control Policy. Full audit logging and alerts are enabled for all administrators. All data stored in Rencore Governance is encrypted and protected behind firewalls in Azure.