Data Security & Management

This guide explains how Elqano handles data security and management. It covers where the application runs, authentication methods, data sources, and storage locations to help you understand how your organization’s data is protected.

Data Security

Where is Elqano bot/application running?

On premise: Elqano application servers run in the client’s Azure tenant.

Saas: Elqano application servers run in elqano’s Azure tenant.

A small package is also added into Teams to integrate the ChatBot with the server application and doesn’t require any interaction with documents.

Nothing is installed on user’s computers.

How is handled authentication in Elqano?

• Web without SharePoint: SSO Authentication is handled via the SAMLv2 protocol using a Microsoft enterprise SSO application hosted on the Elqano tenant as an authentication server. The client must then provide us with the list of users who will have access to the solution.

• Teams / Web with Sharepoint: double authentication:

  • SSO Authentication is handled via the SAMLv2 protocol using a Microsoft enterprise SSO application hosted on the Elqano tenant as an authentication server (to access Playground)
  • SSO Authentication is handled via the SAMLv2 protocol using the Azure Active Directory of the client as an authentication server.  (To connect to SharePoint)

Only users assigned to the SSO application will be allowed to connect to the app.

Where does Elqano data come from?

Elqano retrieves information from three distinct sources:

• Microsoft SSO Login (Via SAMLv2 SSO authentication)
• Microsoft Graph API if the client grants the connection to SharePoint. Otherwise, the client can directly send to Elqano the documents to be indexed.
• Microsoft Teams (via API and HTTP callbacks), for apps available in Teams (Connect and Playground)

Where is stored the application data?

The application data is stored into 3 datastores:

• PostgreSQL for the questions, answers, user activities and all app related data
• AzureSearch for the indexed document content
• Azure blob storage as temporary document store

On-premises: These systems are managed by the client Azure tenant.

SaaS: These systems are managed in Elqano Azure tenant.

The access to these datastores is secured and limited to the application servers only.

Where do users’ documents come from?

User’s documents are retrieved from Microsoft SharePoint Online via the Graph API or directly from the sending of the documents by the client.

If the options are configured in the application, users might also be able to attach documents from their local computers to the answers posted in the bot or in the web interface. These documents will then be stored on the document storage of the application in the Azure tenant of the client (On-premises) or in the Azure tenant of Elqano (Saas).

They will be accessible only via the application.

Where are the indexed documents stored?

During the indexing phase, documents are stored temporarily into the document store of the application (Azure Blob Storage) only for a short time.

Once indexed the documents are removed from the storage.

The document content is indexed into the application vector store (Azure Search) running in the Azure tenant of the client (On-Premises) or azure tenant of Elqano (Saas).

How are exposed SharePoint documents?

Elqano will never proactively expose SharePoint documents.

SharePoint documents shared via the bot will remain on SharePoint and only a link pointing to the document will be published in Teams messages. The permissions on documents defined in SharePoint will be applied.

Elqano is also able to ignore documents with sensitivity labels enabled.

Elqano’s SaaS architecture is built on a multi-tenant application design with tenant isolation ensured through authentication mechanisms. This approach guarantees secure and isolated access to data, maintaining strict separation and integrity for each tenant while upholding the highest security standards.

Source: Microsoft, Multi-tenant SaaS database tenancy patterns.

Is Elqano exposing private data over the internet?

No public data is exposed in Teams and/or in the web interface without secured authentication.

Is Elqano secure?

Elqano is using state of the art security mechanism:

• Full HTTPS
• Delegated SSO authentication via SAML
• XSS/SQL injection enforced protection
• Teams HTTP callbacks signature checks
• Authenticated and filtered database access
• Encrypted sensitive data into application database

Data Management Policy

Elqano needs to gather and use certain information about individuals. This policy describes how this personal data must be collected, handled and stored to meet the company’s data protection standards – and to comply with the law.

This data management Policy ensures Elqano:

• Complies with data protection law and follows good practice
• Protects the rights of customers, staff and partners
• Is transparent about how it stores and processes individuals’ data
• Protects itself from the risks of a data breach

Once Elqano is installed on the customers server, it crawls platforms identified and selected with the client.

Data Accessibility

To continue to improve Elqano algorithm and keep improving user experience, a part of Elqano team, the support team, will have access to a selected part of customer data.

Those selected members, including customer success managers will have one personal access to customer’s admin Elqano account. They are not allowed to copy, share, or amend any customer data. Each customer success manager will sign an NDA with the customers he/she is in charge of.

Data Protection Officer

Gabriele Barbieri, dpo@elqano.com

Data disposability

Customer can request at any moment the deletion or transfer of data. The deletion or transfer must be done within 2 weeks after request. Users can request at any moment the deletion or transfer of their personal data. The deletion or transfer must be done within 1 week after request.

Privacy & Personal Data

Last updated: 24/08/2026

Identification

Elqano SAS, a simplified joint-stock company registered in France (RCS Bayonne), registered office: 2 avenue de la Butte aux Cailles, 64600 Anglet, France — contact@elqano.com.

This policy applies to the Playground platform (playground.elqano.com). Our website elqano.com is covered by a separate policy.

Elqano SAS processes personal data in accordance with the General Data Protection Regulation (EU 2016/679) and applicable data protection laws.

Data collected, purposes and legal bases

Payment details are collected and processed directly by our payment provider and are not stored on Elqano servers. Where you sign in through a third-party account, we receive your name and email address from that provider.

The campaign origin identifier is a technical parameter present in the address of the page you arrive on. It is not stored on your device and is not used to build an advertising profile or to target you with advertising.

Elqano does not request special categories of personal data and asks that you do not submit such data through the platform.

Two access paths, two perimeters. The three rows marked self-service sign-up only apply when a user creates an account directly on playground.elqano.com: billing runs through our payment provider, a welcome message is sent, and the campaign origin identifier is read from the arrival URL.

Use of submitted content

The documents you submit and the deliverables generated are processed solely to provide the platform. They are not used to train, fine-tune or otherwise improve artificial intelligence models, whether Elqano’s or those of its providers. The designers of the models used have no access to the content you submit.

Access by Elqano teams to customer data is limited to the support team as described in Data Accessibility.

Recipients

Your data is intended for the internal teams of Elqano SAS. It may be transmitted to the following categories of processors, strictly within the scope of the purpose for which it was collected:

• hosting and infrastructure providers;
• cloud infrastructure providers hosting, within the European Union, the artificial intelligence models used to generate your deliverables;
• providers of tools used to collect and analyse usage of the platform;
• payment and billing providers;
• email delivery providers;

Each is bound by a data processing agreement and may not use the data for its own purposes. The list of processors currently in use is available on request at dpo@elqano.com.

Data may also be disclosed where required by law or a competent authority, and in the event of a merger, acquisition or transfer of assets. Elqano SAS does not sell personal data and does not transmit it to advertising platforms for targeting purposes.

Transfers outside the European Union

Data, including the content you submit, is hosted and processed within the European Union: in the client’s Azure tenant for On-premise deployments, and in Elqano’s Azure tenant — with AI models hosted in Sweden — for SaaS.

Should a transfer outside the European Economic Area become necessary, it would be governed by the appropriate safeguards provided for by the regulation, in particular the European Commission’s standard contractual clauses or an adequacy decision.

Cookies and trackers

The platform uses no cookies or similar technologies for analytics, advertising or profiling. The only data stored on your device is what is strictly necessary to keep you signed in.

Usage measurement is carried out server-side, from Elqano’s own infrastructure.

Your rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access — obtain a copy of your data
• Right of rectification — correct inaccurate data
• Right to erasure — request deletion of your data
• Right to restriction — restrict the processing of your data
• Right to portability — receive your data in a structured format
• Right to object — object to processing based on legitimate interest, including the welcome message
• Right to withdraw consent — withdraw your consent at any time

To exercise these rights, contact our Data Protection Officer at dpo@elqano.com. Requests for deletion or transfer are handled within the timeframes set out in Data disposability; any other request receives a response within one month, a period which may be extended where the request so requires.

Each message sent by Elqano SAS contains an unsubscribe link.

You also have the right to lodge a complaint with the relevant supervisory authority — in France, the CNIL (www.cnil.fr).

Minors

The platform is a professional tool and is not intended for individuals under 16. Elqano does not knowingly collect data relating to minors.

Third-party links and integrations

The platform may link to third-party sites or connect to external tools (Microsoft SharePoint, Teams, and any other integration enabled by the client), whose data practices are governed by their own policies and for which Elqano SAS is not responsible.

Changes to this policy

Elqano SAS reserves the right to modify this policy at any time. The date of the last update is indicated at the top of this section. In the event of a material change, users are informed within the platform or by email.

Robustness

Azure Health Checks

To ensure the reliability and performance of the Elqano application, we utilize Azure Health Checks. These checks continuously monitor the health of our application services, allowing us to proactively address any issues and maintain optimal uptime. This integration ensures that our infrastructure remains robust and responsive to user needs.

Monitoring User Indexation

Elqano implements a system to monitor user indexation to prevent excessive resource usage. By tracking the indexation process, we ensure that the system operates efficiently and that resources are allocated appropriately. This monitoring helps maintain the performance and scalability of the application.

Serverless Dynamic Task Orchestration

To optimize task scheduling and execution, Elqano employs Prefect push work pools. This approach allows us to schedule work on serverless infrastructure without the need to run a dedicated worker. By leveraging serverless capabilities, we enhance the flexibility and scalability of our operations, ensuring that tasks are executed efficiently and cost-effectively.

FAQ