Email Compliance That Makes Business Sense

Maya Bickson: Hello, thank you for joining us today. This is the sixth episode of “The Future of Information Management” event series. We'll be talking today about email compliance that makes business sense. Before we get started, I have a few important messages during the webinar. Please feel free to submit questions via the chat window on your screen. We will try to answer all your questions at the end of today's webinar. If we don't answer any questions, don't worry. Someone from harmon.ie will answer you via email. As always, we are recording this webinar and we'll email it to you within a couple of days.

Okay. I would like to introduce today's speaker Yaacov Cohen. As the founder and CEO of harmon.ie, Yaacov is a driving force for humanizing technology. He believes technology should work for people and combines this into the nuances of building compliance solutions for global enterprises. Under his leadership, harmon.ie builds tech interfaces that protect companies while advancing human interactions both in the workplace and outside of it. We also want to thank Julia Stettner, service manager for Microsoft 365, information protection, and governance at Allianz Technology, for recording a demo for us that we'll play later. Yaacov.

Yaacov Cohen: Hi. Hello everybody and thank you for joining this sixth event in the series of “The Future of Information Management.” And today we will be talking about something you may be experiencing, which is a tension between business units and compliance and legal. And we would like to share with you today how to deal with this tension between business units and compliance. And we would also like to take a use case of Allianz, which has solved this tension when it has delivered compliance to 180,000 Microsoft 365 users across 52 operating business units. So, we're going to share the Allianz experience. We'll also share a demo of Julia showing you the actual implementation, and we will talk about the roadmap to really achieve an email compliance that makes business sense and to alleviate this tension between business and compliance.

And basically, if you take a look at it, legal are saying emails are a liability while business units are saying emails are an asset. So who is right? And you may be facing that in your organization. You may not call it the “retention battle,” but in a lot of organizations that we have worked with there is a retention battle going on, and it goes that way. For legal, really, emails are a liability because GDPR is becoming more and more important. I mean everybody is very much driven by GDPR. Nobody wants to breach GDPR. And for example, if you simply keep emails with performance reviews for employees or you keep CVs from candidates, you may be breaching GDPR and you may be liable, your company may be liable. The other thing is there are more and more lawsuits. A lot of them are frivolous lawsuits and you may have a court subpoena to ask you to deliver emails in order to answer these types of lawsuits. The more email you have, the more evidence which can be leveraged by the other party. So for legal units it makes a lot of sense to minimize the number of emails which are being kept. The other thing, in terms of IT, is the more information you keep and the more emails you keep, the more potential of information leak you have if there is an intruder. So again, having less information and less email is also better for security.

So these are some of the arguments for why you want to minimize the number of emails. Also storage. You know, there’s only so much storage, and storage costs in the cloud are actually growing, are rising. These are a lot of good motivations to really think twice. And what legal will want is to limit the period of retention for email. For example, 90 days. Now on the other hand, for business units, emails are crucial to keep business continuity. You want to keep the communication with a supplier. You may have critical attachments with contracts. You may have within the body of the email some additional commitments that you want to make sure are being recorded. You want basically to have a record management system, and emails are an important part of that.

The other thing with business, you want to reuse content. If you are a sales team, you may want to have access to previously sent or previously presented presentations, previously presented proposals, marketing materials. We are always building marketing materials from all the old marketing materials, and that's evolution of the marketing materials. And so being able to maintain and keep email and classify email in an easy way is a requirement for business units.

What do we do with these conflicting requirements? So it may look like that in your company. This is Melanie, our head of legal, and she insists the company delete all external emails that are more than three months old, and she says “Violating GDPR is a major risk that we can't take.” And she's right to a degree. On the other end, this is Josh, our head of Professional Services, which all our customers love. And Josh wants all emails retained for as long as possible so his team can deliver to clients more efficiently. “Delivering these emails will affect our bottom line, we can't afford that.” And then for Kevin, our IT manager, he's getting these conflicting requirements. The top management doesn’t make a clear decision. He keeps hearing from legal, Melanie's team, and from Josh and his team, and he really doesn't know what to do. This might be a problem of IT. It might be a problem for information management. They are really being caught in the crossfire.

So, what do we do? But then Kevin and his IM team came up with a pretty brilliant idea, which potentially will mitigate both sides and will meet both requirements. So we will dispose of all emails within a given period, let's say 90 days. It will be deleted, but we will provide to the business – to Josh – selective email retention, a way to save emails selectively by business users, by the various business units. They will be able to save these emails in a central repository to capture these emails, to classify these emails and to apply retention labels. This way we have a much more selective email retention. We don't keep everything and we don't delete everything. We keep what only makes sense for the business. Who decides? The business user.

Now, to implement this type of selective retention policy. Let's take a look at the implementation, and in the case of Allianz and all our customers, they see that SharePoint is a very solid platform for document management, for content management. Unfortunately, SharePoint doesn't really support emails. There is no email view in SharePoint. From a Microsoft standpoint, emails are staying in Exchange and documents are in SharePoint. But with harmon.ie you can actually overcome this limitation and get a complete solution where you get the ability to capture and classify emails and attachments on SharePoint or even on Teams, in the file tab of Teams. This you can do with harmon.ie, and then you can use what you have already licensed, which is under your Microsoft 365 subscription. You have already licensed SharePoint. If you have a E5 license, you have already licensed Microsoft Purview. So with all of these you are using existing assets plus harmon.ie and you're getting a pretty cost-effective solution to implement a selective retention policy. So that's what Allianz did. And before we get to the Allianz demo, we would like to hear more from you about your retention battle.

Maya Bickson: Okay, so thank you Yaacov. Okay, this is the question we would like you to answer, please. Do you feel the email retention tension that Yaacov was talking about in your organization?

And please select one:

• Yes
• Between legal and business units
• Yes, but mainly around retention labels
• No, only legal manages disposition and retention
• This is not something we experience.

We will wait until you answer and then we'll show the results.

Okay, let's take a look. Yaacov, do you see the results?

Yaacov Cohen: Yes. Wow, very interesting. So, we have 65% which see such a retention battle. Only 35% don't see it. But what's also interesting within the 65%, two third are indeed saying that this retention battle is mostly between legal and business units. And for 24% this battle exists but it's mostly around the retention periods or retention labels. That's actually very interesting to see that what we have seen with our customers, 65% of the audience – and we have a great group here of IT leaders and compliance leaders – actually are facing this issue. And this was interesting for us to gather your feedback, so we understand that we need to continue to work on this issue. So thank you.

So, the other aspect that we need to take into account, and that came very, very loudly from the business units at Allianz, is that the key thing is the user, the business user at the end. Because as we said, there is no automation, there is no clear rule to say, okay, this email needs to be saved for business continuity. This is a judgment call by key information workers. So you need to make it very easy because really for the user, they're not paid to save emails, they're paid to do their job. They want to get their job done. And actually in a previous webinar of The Future of Information Management, we asked what is the main obstacle for email retention. And we saw that the main thing for 62% was engaging users.

So really, one of the things you need to think about is, you may have a bunch of meetings with IM and with business units and with legal, and you may come up with solutions, but if the users at the end of the day – who are not in the boardroom – don't follow and don't engage in these programs, you end up with less than 10%. And typically in compliance initiative you have less than 10% compliance. That's one of the challenges we are very busy tackling with Allianz.

Maybe what we will do now is take a demo and we'll talk about what we’re doing at harmon.ie to really try to boost user engagement.

Julia Stettner @ Allianz Technology: I connected my SharePoint site that you've just seen in the browser to harmon.ie. So now I am able to access what I actually see in the browser just via this sidebar and Outlook. So this is just the same as I would see in the SharePoint browser view. You can see this harmon.ie demo dossier that I just created in the browser, and I can now do the same archiving journey for emails as well. So, I can just pick an email and move it into my harmon.ie sidebar. We configured harmon.ie in a way that it automatically detects emails as relevant emails whenever they are uploaded via harmon.ie. The reason for this is that we actually want the user to only upload their relevant emails and not emails that are not relevant from a legal or business perspective. And with that, they just need to select the appropriate document class, as they did for normal documents as well, and save it. And the email is now uploaded into SharePoint into my dossier and is archived properly.

I can do the same for email attachments. So, whenever I receive any file format as an attachment to an email, I can also just drag and drop that file into the sidebar. Again, as you've seen in the browser view, I need to select a contact type for this uploaded file. In this case it's a relevant document and just the same as in browser or for an email, I need to provide a document class.

And now actually all the functionality of SharePoint applies to those files. As mentioned, harmon.ie is just another view into SharePoint.

Yaacov Cohen: And I wanted to summarize a little bit what Julia did. Allianz is using Microsoft Purview and harmon.ie in order to enable these business users to drag and drop emails, drag and drop attachments, into what they call “dossiers.” And they only ask the user to confirm that the email is a business email, what she called a “relevant” email. And then she has a document class, which really defines what should be the retention, and this is being done in the background to define the retention using Microsoft Purview. And really with harmon.ie it's very simple for the users. They just need to drag and drop either an attachment or an email, selected from Outlook without leaving Outlook. They can select the metadata associated with this email. An email view is automatically created and they can see the emails within the harmon.ie sidebar in Outlook. So that's how they're achieving compliance.

One of the key features that harmon.ie provides out of the box is this automatic email view creation. You can file emails on Teams or SharePoint and automatically the email fields like “From,” “To,” “Subject,” and so on are actually mapped to SharePoint columns. So you can very easily filter email from a sender or email about a particular subject and so on. So that's one key thing. The other thing is that all the metadata and even retention labels can be automatically... For example, I may do it here, something we didn't show. One of the main features actually used within harmon.ie and by Allianz as well is this ability to take bulk operations. So I can take multiple emails and I can drag and drop them to the harmon.ie sidebar, and all the emails are being uploaded. And then I can automatically get the metadata and I can fill up the retention label for all these emails. In this case I selected four emails. I can basically fill all the metadata in one click and I can then save. So that's making it very easy. So I need to pick the account name. I can pick the account name from here. There it is. I pick the document type, and that's it. I save. And I can do that for 100 emails or five emails, whatever it is. One of the things to be careful about is to make sure that the business units don't save all their emails but only the relevant emails, and that's where we can talk about it. Our AI will be able to help in this type of scenario as well.

Okay. So, we have seen how business user can very easily apply metadata and apply retention labels. We have over two million emails every month which are uploaded for harmon.ie. And in the past quarter we have about 2 million labels which have been set for harmon.ie. So sometimes the container already has a defined default retention label, but if you need the user to actually apply it manually, this can be done pretty easily. So we have seen how you get a pretty cost effective solution because it's already in your Microsoft 365 subscription. harmon.ie is just an incremental cost on top of your Microsoft 365 subscription and you have a solution which mitigate and answers your legal needs, business needs, and even more importantly, the users’ needs. And that's what we call compliance that make business sense, something which is accepted by all parts of the organization. You can create consensus across legal and the business units, and you can have user needs being answered with simple drag and drop.

The next step in this journey is really to take advantage of AI, and we have been working on how to really facilitate email retention by automating or at least recommending the email retention. The idea is really to train a model, to take the main expert within the company like the legal folks working for Melanie and some users from multiple business units. They know what needs to be saved. So what you can do in order to overcome this limited adoption of 10%, what you can do is to actually train an AI model, a large language model, and learn from this AI training team, this group of experts, what they think needs to be saved. And then harmon.ie will label in the inbox of every one of the enterprise users who has harmon.ie installed. It will suggest to save some of these emails by basically identifying the emails which are semantically similar to the ones which training team has saved.

And this way you take your best team in term of compliance and you take their compliance best practice to the entire organization. So a small group does it right and then all the organization gets the benefits from it. And this way we will also do predictive filing. We'll also tell you where to save it, what label to apply. So really moving from a tool where we're making it easier for the engaged user to do it to really something which is semi-automatic with recommendation within harmon.ie. We'll get this, you have X important emails and every email will have where to save it eventually. What metadata and retention label to apply. And this really is a way to reduce the burden on the users and to make sure that you don't over-retain, because what the training team has saved will be the only thing which will be saved. And the model will get smarter as we move on. And if there is a bulk of emails which are being moved and some emails don't fit what the model has learned so far, there will be a warning to maybe not save these emails.

And what's really important is that the emails stay on your tenant. And the AI is being done without taking the email from your tenant. And actually the AI will be done, all the vector embedding will be done, on the client side with a very unique architecture. And so you get a pretty strong, cost-effective compliance solution leveraging Microsoft SharePoint, Microsoft Purview, and you get something which also maintains your privacy. And this gives you a user-centric solution which really alleviates the tension between business units and legal.

So we have one more poll question.

Maya Bickson: Yes. We wanted to ask, do you think harmon.ie AI can benefit your enterprise compliance? And if you could please answer:

• Yes, absolutely
• I need to learn more
• I don't think so.

And once you finish voting I'll show the results.

Yaacov Cohen: Excellent. So, we have 53% of the participants who are saying absolutely this can help enterprise compliance, and we have 47% who need to learn more, and of course we'll have to talk about it more. And we're also working with our compliance partners to really fine-tune this. So, we're still on our journey and our goal is to deliver harmon.ie AI in the first half of 2024.

Maya Bickson: Thank you, Yaacov. I wanted to thank you for this great presentation, and thank all of you for joining us today. As we mentioned, you will receive an email with a link to view this webinar again within a couple of days. If you have any questions, suggestions, or topics you would like us to cover, please send us an email. And we look forward to meeting you again in our next webinar.

Yaacov Cohen: And you have the links here. We’ll leave the window open so you can go to the links if you want to book a demo or if you want to give it a try. Thank you.

Maya Bickson: Thank you, Yaacov. Bye.