Frequently Asked Questions

Data & More is a privacy and security platform that finds personal and sensitive data in your organisation's email, files and Microsoft 365, then helps you delete what you no longer need. Classification is AI-powered; deletion is verified and keeps a person in the loop. More than 280 organisations use it to enforce GDPR retention in practice.

You connect up to 250 mail accounts and the platform scans them. You get a report that quantifies your Data Privacy Risk Premium: how much non-compliant personal data you hold, how old it is, where it concentrates, and how your compliance rate compares to industry benchmarks. There is no obligation to buy.

Findings are routed to the people who own the data. They confirm what is still needed, move what must be kept to a controlled location, and delete the rest. Every decision has a person in the loop, and deletion is verified rather than assumed. About 350,000 data owners already complete these reviews.

GDPR Article 5 requires storage limitation and data minimisation: you may only keep personal data for as long as you need it, and only collect what you actually need. Holding personal data without a purpose is illegal. Every retained record also enlarges DSAR workloads and the scope of a future breach.

No. Your files are never used for marketing or to train AI models. Data & More ApS is a European (Danish) company and has operated the platform since 2018.

Purview is strong at classifying and labelling data inside the Microsoft ecosystem. Data & More focuses on the step after classification: getting non-compliant data verifiably deleted, with data owners making the keep-or-delete decision, and reporting risk in terms a DPO or board can act on. The two can run side by side; our blog has a detailed benchmark.

Pricing is published on our prices page and scales with the scope you monitor. The easiest way to start is free: monitor 250 mail accounts and see your own numbers before spending anything.

Book a free Privacy & Security review. When the findings are on the table, we plan the rollout together: which systems to include, which retention rules apply, and how data owners will be involved. The implementation page describes the rollout in detail.

Standard connectors cover Microsoft 365 (Exchange Online, OneDrive, SharePoint, Teams), Google Workspace, Exchange and SharePoint on-premise, file shares, MailStore email archives and Slack. A REST API is available for custom connectors, so almost any system that holds unstructured data can be brought into scope.

The platform connects directly to your servers - for Microsoft 365 via the Graph API - and never scans employees' laptops or local caches. It reads the full server-side data set, including older data that was never synced to a local machine, applies OCR to images and scanned documents, and uses AI-enhanced document recognition to identify things like passports and ID cards inside attachments.

OneDrive is scanned per owner, and SharePoint and Teams are scanned per site, with reports sent to the site owners or the site's shared mailbox. Text in Teams channels is scanned; channel attachments are covered by the SharePoint scanner and chat attachments by the OneDrive scanner. Text in private Teams chats is not scanned.

Yes. The share is mounted on the compliance server using a dedicated read/write service account. For hosted setups a point-to-point VPN is included and recommended for up to 25 TB; site-to-site VPN is available when you have more than three on-premise sources; and above 25 TB we recommend an on-premise installation with direct mounts.

File ingestion is based on Apache Tika, which covers hundreds of formats - office documents, PDFs, archives, email formats and more. All text and all images are analysed, with OCR turning scans and photos into machine-readable text. Video content is not analysed by default but can be covered with a third-party add-on.

Continuous. New and existing data is monitored perpetually, and the classification is re-applied nightly as it improves. A first full scan of a large estate can take weeks because every file and image is processed - the scanner works folder by folder, regardless of the age of the data.

Hundreds of distinct document classes: national ID numbers, passports, driver's licences, health information, salary and tax records, recruitment files, employment agreements, union membership, political and religious orientation, travel records and many more. Behind them sit dictionaries and phrase libraries of over 500,000 objects in 25 languages - the Danish CPR number alone is identified by more than 25 different methods.

A dedicated classification team maintains the model and refines it with feedback from hundreds of thousands of users on false positives and false negatives. The central model is updated daily, and every customer installation is reclassified nightly - so improvements reach end users immediately instead of months later.

If something is flagged that should not be, the data owner marks it as misclassified - it disappears from the report and the classification team uses the feedback to improve the model. Data that should have been flagged but was not can be collected in a folder named 'DM false negatives' for the team to review. The data itself never leaves your installation.

Because GDPR defines personal data as anything relating to an identifiable person - including location data. A flight booking documents where a named person was at a specific time. Once the trip is over the original purpose has lapsed, and under the storage-limitation principle the record must be deleted unless there is a documented reason to keep it. A Danish taxi company was fined precisely for keeping journey data too long.

Yes. The security classification identifies passwords and secrets, source code that exposes credentials, log files, infrastructure configuration, vulnerability assessments, digital certificates, network access rules and similar material that would help an attacker if it leaked - built on feedback from hundreds of CISOs and infrastructure specialists.

Best practice: files older than three months that contain personal data appear in a personal clean-up report, sent out quarterly. Data owners then have three months to keep, move or exempt items. Anything left unhandled is moved to the GDPR vault and then deleted - so nothing disappears without a human having had the chance to intervene.

They can mark items as Private (exempt from all future reports), Misclassified (not actually sensitive - feeds the classification team), or Dispensation (kept while an ongoing matter lasts). Content in folders named 'Private' is respected automatically. Everything else is deleted at the end of the decision window.

After the deadline set by your organisation, the unhandled items are moved to the GDPR vault and subsequently deleted. The timeline and the exemption options are communicated in the report itself, so ignoring it is a decision - not an accident.

Within your normal Microsoft 365 retention windows, yes. Mail deleted in Outlook goes to Deleted Items and is typically recoverable for 30 days. OneDrive and SharePoint keep deleted files in recycle bins for 93 days, with a second-stage bin for admins and version history for overwritten files. Legal holds are respected throughout.

Yes. The cleanest way is to scope scanning to an AD group that contains only the users who should participate. Alternatively an exemption AD group can be configured, and folders with agreed names (for example 'private' or 'to be kept') can be excluded from the process.

Yes. The manager report gives team leads an aggregated view of their team's clean-up status - processed, pending, unaddressed - without exposing the content of anyone's data. Managers are picked up automatically via the Manager attribute in Azure AD once the feature is enabled in your policy.

The platform is granted no rights your IT department does not already have. Each clean-up report is personal and visible only to the owner of the mailbox or drive. The project team can perform spot checks to verify the solution works as intended - and that access is itself governed by an approval procedure.

Your choice. As a hosted service it runs on EU infrastructure in ISO-certified data centres in Germany and Finland, with strict physical access control, redundant power and GDPR Article 32 technical and organisational measures. Enterprises can instead run the full platform on-premise or in their own Azure, AWS or Google Cloud environment.

All communication is encrypted with TLS 1.3 and all data is encrypted in transit and at rest. Remote access runs over OpenVPN, the platform is continuously monitored for abnormalities and scanned for vulnerabilities, and the operation is ISAE 3000 and ISAE 3402 audited.

You control access to your data at all times and can revoke it whenever you want. When access is revoked, all data on the compliance server is deleted within 72 hours.

Create an Azure app registration with Microsoft Graph application permissions and grant admin consent - a step-by-step guide is on the support portal. A trial needs only read permissions on mail; production adds write permissions so deletions can actually be executed. For most organisations one meeting with an IT security admin is enough.

Yes. Scanning scope is controlled by AD/Entra groups, so only selected users are ever read. Application access policies can restrict the app registration to specific mailboxes, and mail send-out can be limited to a single account. You keep control of both access and scope at all times.

Yes. The platform installs on Ubuntu or RedHat with Docker - on bare metal, on VMware, or in Azure, AWS or Google Cloud (Hyper-V is not supported). A single server handles up to roughly 2,000 accounts or 25 TB of data; beyond that a cluster is used. Your team manages the OS; Data & More maintains the application.

A proof-of-concept server is modest: Ubuntu 24.04, 16 threads, 128 GB RAM and a 1 TB NVMe disk covers up to about 20 accounts and 1 TB of data. A single production server steps up to 36 threads, 160 GB RAM and storage of roughly 10% of the data volume being indexed.

Generate a new secret in the Azure portal, send the new value to Data & More support, and wait for confirmation before deleting the old one - deleting it early causes an immediate access outage. We recommend a 24-month expiry and a calendar reminder 30 days before it runs out.

Yes. The Copilot Protection module works with Microsoft Purview sensitivity labels: a label that withholds the 'copy and extract content' permission blocks Copilot from consuming an item. Data & More identifies which documents contain privacy data and applies the label to exactly those - far more accurately than Microsoft's auto-labelling.

After a signed PoC agreement and data processing agreement, you pick 10-15 mail accounts and a small project group. One IT meeting connects the data, the platform scans it, and a workshop walks through classification, analytics and the clean-up flow - project members try the report on their own data. Nothing is deleted during a PoC, and it ends with an evaluation of the key findings.

A small project team, one meeting with an IT security admin to set up access, and participation in a handful of workshops through the rollout. Data & More brings a standard best-practice project plan, communication templates and base configuration, so you are not designing the process from scratch.

First-level questions go to your own helpdesk, which knows your internal policies. Anything deeper goes to support@dataandmore.com - our ticket system - with your workspace name, a description and screenshots. Tickets are answered within 24 hours, and larger clients can get access to a ticket portal.

The support portal at support.dataandmore.com holds over 100 articles and videos in English, Danish, Swedish and German - covering IT setup, app registration, data source configuration, onboarding plans, mail templates, security documentation and release notes.