Skip to main content

​
Getting started

Most teams see their first discovered apps within several minutes of connecting an organization provider. Initial synchronization time depends on provider response time, organization size, and the data available in the tenant.The governance features (findings, OAuth grants, Shadow Apps) populate as provider synchronization completes.
No — start with the provider your administrator can connect and add another provider later if needed. Each provider adds a different type of organizational context:
  • Google Workspace or Microsoft Entra — applications, directory context, activity, delegated access, and relevant vendor signals where supported
  • Okta — applications, assignments, directory context, and authentication activity
  • Browser extension — application and security signals for tools outside the provider
Start with whichever provider your organization is ready to authorize.
  • Google Workspace — Super Admin (service account and domain-wide delegation)
  • Microsoft Entra ID — Global Administrator (administrator consent)
  • Okta — Okta administrator who can create an API token
  • Browser extension — No admin required for an individual install; browser-management admin for an organization-wide rollout
Yes. Connect each organization provider from Settings → Integrations. Porcia keeps the resulting application and access context in one inventory and avoids treating the same application as separate discoveries where matching is available.

​
Provider mailbox signals

No. When mailbox signals are available through a supported Google Workspace or Microsoft Entra connection, Porcia looks for relevant vendor signals such as invoices, renewals, signups, and permission notices. It does not send email from connected customer mailboxes.
No. For connected Google Workspace and Microsoft 365 mailboxes, Porcia only looks at SaaS notification emails, such as signups, invoices, and renewals. They are processed in memory and discarded afterwards. Email bodies and attachments are never saved.Porcia keeps only the structured details it needs, such as the app or vendor name, the date, and billing information from invoices.
No. The supported organization workflow uses the provider connection. Some workspaces may have a legacy forwarding fallback, but it requires per-user rules and is not equivalent to the organization-provider connection.Forwarded messages are handled differently from the provider connection. See the privacy policy for details.

​
Provider and directory access

Directory user data (name, email, department, group memberships, MFA status) is used to:
  • Show who has access to which apps
  • Calculate license utilization (access vs active usage)
  • Target pulses to the right people
  • Power offboarding playbooks
  • Attribute discovery events to specific users or teams
Access to user-level data is controlled by role. Admins can see organization-wide detail, and other roles see only what their assigned data scope allows.
Discovery does not automatically add users, remove users, change assignments, or modify provider configuration. Supported administrative actions, such as OAuth-grant revocation or enabled offboarding actions, require the relevant permission and explicit confirmation.
Porcia syncs Okta users (including deactivated users), groups, group memberships, and admin roles. Contact support if you need specific custom profile attributes.

​
Governance

Findings are security posture issues surfaced automatically by Porcia — for example, a high-risk OAuth grant, an employee using an app outside of SSO, a sideloaded browser extension, or a deprovisioned user who still has active app access.Each finding has a risk level, context, and guided remediation steps. You can work on and resolve it, reassign its owner, or request a time-limited risk exception with a justification.
A rule checks supported events against your conditions and automatically sends an email, a Slack message, or a pulse when they match.A playbook is a multi-step workflow you run to complete a structured process, like offboarding, where a sequence of steps is completed by different people.Think of rules as automatic alerts and playbooks as checklists with accountability.
Admins can cancel a pulse that hasn’t been answered yet. Once someone has responded, it can’t be cancelled.
Employees can snooze a type of pulse for 7, 14, or 30 days, or opt out of a specific type of pulse. Future sends respect both.

​
Browser extension

The extension reports application-level and security signals for the controls your workspace enables, such as sign-ins and signups to SaaS apps, AI tool use, and security risks. Signals are reported by domain, never by full page URL.
  • Password values never leave the device. Only password-health signals, such as strength or reuse across sites, are reported.
  • Sign-in addresses: by default only whether a work account was used is recorded. If your workspace turns on shared-account detection, the sign-in address is also collected and stored encrypted.
  • AI prompts and uploads are checked on the device. By default only the types and counts of sensitive data are reported. Workspaces can choose to also keep masked evidence, which never includes the full sensitive values.
The extension does not record keystrokes or general browsing history. Common consumer sites are excluded from app discovery.
Where the workspace allows it, employees can pause detection from Porcia. Nothing is collected or queued while paused. Managed deployments may not offer pause.
Not by default. It can be turned on through the browser’s own extension settings (“Allow in Incognito”) or through your organization’s browser policy.
The Porcia extension also reports the other browser extensions installed on each device, such as their name, version, permissions, and how they were installed.This powers the Security → Browser view, where admins can review extension risk across the org and ask enrolled browsers to disable or remove an extension. Removal may need the user to confirm.

​
Privacy & security

Porcia is hosted on AWS in the United States. If you have data-residency requirements, contact [email protected].
Porcia is designed around data-minimization, purpose-limitation, access, deletion, and portability principles. Availability of DPAs and other contractual materials depends on your plan and agreement. Contact [email protected] for the current approved information.
No. Porcia does not sell your data. Porcia may use aggregated information, such as how applications are identified and general pricing benchmarks, to improve its app catalog. Your workspace’s data is never visible to other customers. See the privacy policy for details.
Connected-provider mailbox access is used for supported vendor signals and is not used to send mail from customer mailboxes. Pulses use their configured delivery channel, including email sent from Porcia’s own sender system, Slack, or Microsoft Teams.
An admin can delete the workspace from Settings → General → Danger Zone. Access ends right away. Support can restore the workspace for 90 days, and the data is then permanently deleted.Export what you need first. You can download apps, findings, OAuth grants, pulses, and audit logs from their pages, and your own personal data from Settings. For an individual’s data deletion, contact [email protected].

​
Billing

Billing is based on the active users in your connected identity providers (Google Workspace, Microsoft Entra, Okta). Contact [email protected] if you need a breakdown of your count.
The 200/monthfloorapplies.Youwon′tpaylessthan200/month floor applies. You won't pay less than 200/month regardless of how few active directory users you have. This is the minimum for the Standard plan.
Yes. Manage or cancel your subscription from Settings → Billing, which opens the billing portal. Access continues until the end of the current billing period. After that, workspace data is kept for 30 days in case you resubscribe. The workspace is then suspended, support can restore it for 90 days, and its data is then permanently deleted.

​
Still have questions?

Contact support

Email us at [email protected] — we reply within 24 hours

In-app chat

Use the chat icon in the bottom-right corner of the app

Schedule a demo

Talk through your use case with our team

Provider connection issues

Troubleshoot organization-provider setup and synchronization