Everything a security reviewer, auditor, or skeptical engineer would ask — including what we don’t cover and don’t yet have.
| Coverage & capture | |
|---|---|
| Monitored services | ChatGPT, Claude, Google Gemini, Microsoft Copilot, M365 Copilot, Perplexity — web versions on the managed browser. The list is not static: as new AI services gain real adoption, full monitoring is added and reaches every fleet server-side, with no redeployment. Shadow AI discovery (below) is the early-warning system that tells us — and you — what to add next. |
| Captured per event | Prompt text at submit time. File uploads by filename, byte size, and MIME type — file contents are never read or transmitted. |
| Shadow AI discovery | On by default; can be disabled per fleet. Matches visited domains against a maintained watchlist of AI services (DeepSeek, Grok, Poe, Character.AI, and others). Domain match only — never page content, never general browsing history. |
| Site coverage updates | Site handlers are fetched from the server, so an AI site redesign or a newly added service reaches endpoints without redeploying the extension. |
| Offline behavior | Events queue locally on the device and sync on reconnect. Verified in testing at seven days of queued activity delivered intact. |
| Microsoft 365 Copilot | Copilot in Teams, Outlook, Word, Excel, PowerPoint, OneNote, the Edge sidebar, the Copilot app, and Cowork — sourced server-side from the Microsoft Purview audit log, so it covers every device including unmanaged ones. Per interaction: user, time, host application, whether the web was searched, every resource Copilot read, and Microsoft’s own jailbreak and prompt-injection flags. Sensitivity labels on those resources are read where a tenant publishes them. Prompt text is additionally captured for users holding a Microsoft 365 Copilot license; it is not available for free Copilot Chat users — a Microsoft licensing boundary the portal states plainly, per user. Copilot’s responses are never collected. |
| Connected AI apps | A daily audit of third-party applications that have been given access to the Microsoft 365 tenant (OAuth consent grants — the “Allow this app to access…” permission screen) — what data they can reach (mail, files, calendars, meetings), whether consent was granted by an admin or clicked through by an employee — matched against a maintained catalog of AI vendors (meeting-transcription bots, chat connectors, writing assistants). Unrecognized apps with data access are surfaced too, at a lower band. Works on every Business and Enterprise plan. |
| Deployment | |
|---|---|
| Platform | The agent is a browser-level extension, not an OS agent — any device running managed Chrome or Edge is compatible, including macOS. Turn-key deployment tooling (the one-script policy install) ships for Windows today; macOS deployment profiles (Jamf / Intune for Mac) are on the near-term roadmap. Safari is not supported (non-Chromium). |
| Browsers | Chrome and Edge (single Chromium extension). |
| Method | One PowerShell script covering any RMM, Microsoft Intune, Group Policy, or manual install. All four set the same Chrome/Edge enterprise policy: force-install plus managed configuration. |
| Tamper resistance | Installed by enterprise policy — employees cannot disable, remove, or reconfigure it. |
| Enrollment | Per-customer enrollment keys, revocable instantly. The script is idempotent and self-healing on re-run. |
| Time to visibility | Devices report into the portal within minutes of the policy applying. |
| Microsoft 365 connection | No agent. One admin-consent link, opened by the customer’s Global Admin (or a delegated administrator). Application permissions, all read-only: Directory.Read.All, AiEnterpriseInteraction.Read.All, InformationProtectionPolicy.Read.All, AuditLog.Read.All, and ActivityFeed.Read on the Office 365 Management API. Certificate credential — no client secret. Disconnect at any time from the portal. Connected AI apps and license coverage appear within minutes; the first Copilot activity typically within minutes as well, though Microsoft’s audit pipeline can take up to 12 hours. |
| Risk pipeline | |
|---|---|
| 1 · On-device redaction | Social Security numbers, payment card numbers, and API keys are pattern-detected and replaced with typed tokens on the endpoint, before transmission. Counts ship with the event; values never do. Proven at bulk scale in testing: 800+ SSNs in one paste, zero transmitted. |
| 2 · Classification | Each redacted prompt is scored 0–100 for business risk and tagged by category: PII, PHI, credentials, source code, financial, HR, legal, harmful use, and each customer’s own custom terms. Copilot interactions without prompt text are scored by deterministic rules — labeled documents read, web grounding, Microsoft’s safety flags — so they enter the same alert queue. |
| 3 · Alerting | Events at or above threshold band as medium, high, or critical — thresholds set per customer. High-severity events get a written incident summary: what happened, why it matters, suggested next step. |
| 4 · Notification | Email digests dispatched within a minute of capture. Severity level is set per recipient, so the on-call tech, the account manager, and the compliance contact each get a different threshold. |
| 5 · Triage | A filterable alert queue by severity, category, and date. Each alert carries the redacted prompt, classification, and summary, with a resolve/reopen workflow and review notes forming the audit trail. |
| Data handling, access & tenancy | |
|---|---|
| Retention | Per customer, 7 to 365 days. Prompt text is purged nightly past the window; alert metadata and the audit trail persist for compliance continuity. |
| Tenant isolation | Enforced in the database with Postgres row-level security — every query is scoped to the caller’s organization rather than filtered in the UI. |
| Accounts | Invite-only, no open signup. Five roles from partner admin down to read-only customer viewer; customer-level users see exactly one organization. |
| Domain guardrails | Portal users and alert recipients must hold email at the customer’s own domains. Exceptions require a deliberate, logged settings change. |
| Operator access | Platform staff hold no standing hands-on access to customer environments. Entry is only via an explicit, audit-logged support session that the partner can see — and it ends on exit. |
| AI processing | Risk scoring runs under agreements that prohibit training on the data. Data is never sold and never used for advertising. |
| Microsoft 365 data | Copilot prompt text (licensed users only) is redacted on our servers with the same patterns the extension applies on-device, before it is stored, and purges on the customer’s retention schedule like any other prompt. Copilot’s responses are never stored. Which files Copilot read, and which apps hold access, persist as posture records. |
| Reporting & multi-customer | |
|---|---|
| Dashboard | Activity and alert trends, usage share by AI service, users needing attention, redaction totals, risk rate. |
| Drill-downs | Per-endpoint and per-user views of which people and devices use which AI services. |
| Exports | Executive AI Usage & Risk report and an alert detail report — both branded PDF — for quarterly reviews and compliance requests. |
| Multi-customer | A scope switcher flips the console between all customers and any single one. White-label puts the provider’s name, logo, and brand color on the portal and reports the end customer sees. |
| Coverage boundaries | |
|---|---|
| Covered | Managed Chrome and Edge (Windows deployment tooling today; the extension itself is OS-agnostic) · web versions of the monitored AI services · domain-level detection of other AI sites · Microsoft 365 Copilot on any device, via the tenant connection · third-party apps holding access to Microsoft 365 data. |
| Not covered | Personal and unmanaged devices for public AI sites (Microsoft 365 Copilot is covered regardless of device) · non-Chromium browsers (Safari, Firefox) · native desktop AI applications · AI embedded inside other SaaS products, Microsoft 365 excepted. We pair the technical control with acceptable-use-policy language so the gaps are governed — and we tell you honestly which is which. |
CircleScope runs on Microsoft Azure and Supabase in the United States, both operating SOC 2 and ISO 27001 audited infrastructure. Those are our providers’ certifications, not our own. TLS in transit throughout.