IntraWork

Trust at IntraWork

IntraWork is an AI Strategic Operations Command Centre — built around an agent team running on a customer's own infrastructure. Because every customer deployment is physically separate, our trust posture starts with a structural advantage: there is no shared multi-tenant system holding customer data. Below is a plain-English summary of how we protect what flows through your deployment, and where to find the detail.

How your deployment works

Each customer gets their own forked deployment of the IntraWork Platform — their own Supabase database, their own Microsoft 365 integration, their own Anthropic API key. IntraWork as a company does not aggregate or hold customer operational data. Your deployment is yours.

Where your data lives

By default, Australian customers run on Supabase's ap-southeast-2 (Sydney) region for operational data, and on their existing Microsoft 365 region for mail, calendar, and document data. Compute runs on Microsoft Azure Static Web Apps in the Australia East region.

One cross-border flow is required for the agent runtime to function: prompts and responses to and from the Anthropic API in the United States. Anthropic's Commercial Terms prohibit training models on customer data submitted via the API.

Encryption

TLS 1.2 or higher on every external connection. AES-256 encryption at rest on operational data via Supabase. Microsoft 365 data encrypted per Microsoft's published posture.

Authentication

Microsoft OAuth is the authentication path for operator accounts. Multi-factor authentication is enforced at the Microsoft 365 account layer (the operator's Microsoft 365 MFA policy applies to the IntraWork authentication chain). Additional Supabase-layer TOTP enforcement on administrative routes is enabled.

The architectural primitives we lead with

  • Per-customer self-hosted. Each customer's deployment is physically separate from every other customer's deployment. Tenant isolation is structural, not policy-based.
  • Operator-in-the-loop by architecture. Every AI agent action that touches the outside world routes through an approval queue. The operator reviews, edits, approves, or rejects before anything is sent.
  • Anthropic Commercial Terms. No training on your data.
  • Minimum-necessary Microsoft Graph scopes. We request the access we need and no more.

Documentation

The following documents are available for review:

For our full security questionnaire (CAIQ v4, SIG Lite, or your bespoke vendor risk template), contact us at security@intrawork.com.au for NDA-gated access.

Certifications — where we are honestly

The IntraWork Platform is architecturally aligned to industry control frameworks — SOC 2 Type II controls, OWASP Top 10 for LLM Applications (2025), and the ISO/IEC 42001 AI management system control set. Third-party certification is deferred until customer demand and engagement scale justify the cost; we will pursue certification when a specific engagement requires it as a contractual condition. We maintain a 38-item internal security self-audit (current score: 32/38) and will book an independent penetration test within 12 months of our first paying customer engagement. For procurement teams needing a full CAIQ v4 or SIG Lite questionnaire response, contact security@intrawork.com.au for NDA-gated access.

Reporting a vulnerability

If you believe you have found a security vulnerability in the IntraWork Platform, contact security@intrawork.com.au. We will acknowledge within 24 hours and agree a coordinated disclosure timeline.

Contact

  • Security and vulnerability disclosure: security@intrawork.com.au
  • Privacy enquiries: privacy@intrawork.com.au
  • General enquiries: the contact details on our marketing site.

Last updated: 2026-05-18.