Data Protection
Connected Intelligence is in internal beta and is not yet activated for any client environment. Client activation is expected late 2026. The description below is the data-handling design as it will ship.
Your Data Never Leaves Your Tenant
The most important thing to know about data protection in Sensei IQ is this: your data never leaves your Microsoft 365 tenant.
Sensei IQ is deployed as a Power Platform solution inside your own Dataverse environment. All project data, resource data, portfolio records, and user information is stored in Dataverse tables that belong to your organization — in your tenant, in your chosen region, under your governance.
Sensei Project Solutions does not operate a database that stores your data. We do not receive copies of your data during normal operation. We are not a data processor in the traditional sense.
One exception, by your choice — Connected Intelligence. Sensei IQ offers an optional, opt-in AI service that is off by default. When it becomes available and an administrator enables an advisor and a user runs it, a defined, scoped set of fields is sent over an encrypted connection to a Sensei-managed Azure Function and on to Anthropic's Claude API, and the result is returned.
Retention on that path belongs to two separate parties, so it is worth naming each. Sensei retains no copy of the request or the response. Anthropic deletes API inputs and outputs within 30 days by default; no Zero Data Retention agreement is in place for this service. On training, Anthropic's commercial terms state that "Anthropic may not train models on Customer Content from Services," and commercial API inputs and outputs are not used for training by default — you retain rights to your inputs and own the outputs. If you do not enable Connected Intelligence, everything else on this page applies without exception. See the Connected Intelligence Advisors FAQ.
Encryption at Rest
All data stored within Sensei IQ is encrypted at rest by Microsoft Dataverse using AES 256-bit encryption. This encryption is applied automatically to all Dataverse tables, files, and attachments.
Key management for encryption at rest is handled by Microsoft. Your organization can optionally configure customer-managed keys (CMK) through the Power Platform Admin Center if your compliance requirements demand greater control over encryption keys. This is a tenant-level setting your administrators control — it is not specific to Sensei IQ.
There is nothing additional Sensei needs to configure for at-rest encryption. The protection is built into the platform.
Encryption in Transit
All data moving between users and Sensei IQ — and between Sensei IQ's components — is encrypted in transit using TLS 1.2 or higher.
This encryption is enforced by Microsoft Power Platform and cannot be disabled. It applies to:
- Browser sessions accessing the Power App
- API calls between Power Apps, Power Automate, and Dataverse
- Integrations with Microsoft Graph, Teams, and SharePoint
- External system connectors (Jira, Planner, Wrike, and others)
No cleartext data transmission occurs between any components of Sensei IQ.
When the optional Connected Intelligence service is enabled, the same standard applies to its round trip: the scoped request from your environment to the Sensei-managed Azure Function and on to the Anthropic Claude API is encrypted with TLS 1.2 or higher.
Data Residency & Sovereignty
Your data resides in the geographic region you selected when creating your Power Platform environment. Microsoft does not move data across regions without your consent.
This means:
- If your environment is provisioned in Canada, your Dataverse data stays in Canada
- If your environment is in the EU, your data remains within EU data centers
- Sensei IQ does not alter or override your environment's region settings
Your organization is the data controller for all data within Sensei IQ. For the base product, Sensei Project Solutions is not a data controller or subprocessor for your project data. The data lifecycle — including creation, modification, retention, and deletion — is governed by your organization's policies and your Microsoft tenant settings.
The optional Connected Intelligence service is the exception. When it becomes available and an administrator enables it, Sensei acts as a processor for the scoped fields sent on each advisor request, and Anthropic acts as a subprocessor for that request only. All Sensei-managed infrastructure for this service runs in US-region Azure (West US), so if your environment is provisioned outside the United States, that scoped request is processed in the US for the duration of the call. The region you chose for your own environment is unchanged, and the rest of your Sensei IQ data never leaves it.
If your contract requires data to remain within your own tenant, the Sensei-managed option does not meet that requirement. The self-hosted (Bring Your Own Model) option does, and is targeted for early 2027. See the Connected Intelligence Advisors FAQ.
Sensei Access to Your Production Data
Under normal operating conditions, Sensei staff have no access to your Dataverse data. There is no back-door connection to client environments, no replication of client data to Sensei systems, and no telemetry pipeline that transmits business data to Sensei.
When clients request support or implementation assistance, a Sensei consultant may be granted temporary access to a client environment by the client's own administrators. This access:
- Requires explicit authorization from the client's tenant administrators
- Is granted through standard Dataverse user assignment within the client's own identity platform
- Is audited through Microsoft Purview and Power Platform audit logs, which the client controls
- Can be revoked at any time by the client
Sensei does not retain any form of persistent, standing access to client environments.
Application Telemetry
Sensei IQ uses Azure Application Insights for application-level telemetry — performance monitoring, error detection, and usage analytics. This telemetry is:
- Limited to application performance data (page load times, errors, event counts)
- Designed to be free of personally identifiable information (PII) and business data
- Used by Sensei for product improvement and issue resolution
No project records, resource data, financial information, or user-identifiable business content is included in telemetry.
Connected Intelligence. Advisor requests and responses are not written to telemetry. Three layers are worth separating:
- Client side — every suggestion a user accepts is written as an ordinary Dataverse field update by that user, so standard Dataverse auditing captures who changed what and when
- Sensei side — operational telemetry only (invocation, duration, record counts, errors) through Application Insights. Prompt and response bodies are not logged, and this telemetry carries no business data
- Provider side — governed by the Anthropic retention terms described under Your Data Never Leaves Your Tenant above
Data Minimization
Sensei IQ is designed to use only the data it needs for its defined functions — project and portfolio management. It does not collect data beyond what is required to deliver its capabilities. Sensei does not profile users, aggregate data across client tenants, or build derived datasets from client information.
The same principle governs the optional Connected Intelligence service: each advisor sends only a defined, named set of fields required for that specific request — not your whole project, and not unrelated records.
Minimization is not anonymization. Data sent to an advisor is not anonymized, masked, or pseudonymized. The control is minimization: only an explicit, named allow-list of fields leaves the tenant. If a listed field contains a personal name, it is sent as-is. Where that allow-list lives depends on the advisor — for the Risk and Status advisors it is held in a configuration setting administrators can review and narrow (the Status advisor also sends the project's previous status update, which is part of the advisor rather than the list); the Insights advisor's list is fixed in the advisor rather than in configuration; and the Capture advisor sends the document content you stage, bounded by that staging list rather than by a column list.