Integrations Overview¶
WorkDone products connect to a small, well-defined set of systems in your environment. Every integration is scoped, approved, and revocable by you. This section describes what each integration does, what you need to provide, and how access is controlled.
Integration setup is white-glove: your WorkDone implementation contact works with your IT team through each step. These guides tell you what to expect and what to prepare.
Supported Integrations¶
| Integration | Product area | Direction | Guide |
|---|---|---|---|
| Microsoft SharePoint | Corporate Memory: Copilot knowledge base | Read-only ingestion | SharePoint |
| Google Drive | Corporate Memory: Copilot knowledge base | Read-only ingestion | Google Drive |
| Business systems & ERP | Workflow automation | Secured data exchange scoped per engagement (writes only after your approval) | Business Systems & ERP |
| Teramind | Vision Dashboard and AI Transformation Accelerator assessments | Read-only analytics feed | Teramind |
| SSO & identity | All products: sign-in and access control | N/A | SSO & Identity |
General Principles¶
The same security posture applies to every integration:
- Least-privilege service accounts. Each connection uses a dedicated identity with the minimum permissions required for its job: never a personal account, and never broader access than the integration needs.
- Read-only wherever possible. Document ingestion (SharePoint, Google Drive) and Teramind analytics are strictly read-only. The only write paths are the workflow-automation updates to your own business systems, and nothing is written back until a person in your organization reviews and approves it in the portal.
- You control the scope. You decide which SharePoint sites, Drive folders, ERP data sets, and observation windows are shared. Access can be narrowed or revoked by you at any time; the integrations are designed so that revocation on your side immediately cuts off WorkDone's access.
- Encrypted in transit. All integration traffic uses encrypted channels: HTTPS/TLS for API connections and SFTP for file exchange. The WorkDone portal itself is served exclusively over HTTPS.
- Organization-scoped tenancy. Everything ingested through an integration lands in your organization's isolated tenant. Your documents, part data, and analytics are never visible to any other WorkDone customer. See SSO & Identity.
Note
WorkDone products are hosted on Microsoft Azure. If your security team needs details on hosting, data residency, or our compliance posture, contact support or email support@workdone.ai.
What Setup Looks Like¶
- Scoping call. You and your WorkDone implementation contact agree on exactly which data sources are in scope.
- Credential exchange. Your IT team provisions the least-privilege account or app registration and shares credentials over a secure channel agreed with WorkDone.
- Validation. WorkDone verifies connectivity against the agreed scope (and nothing beyond it) and walks you through the first sync or data run.
- Ongoing operation. Syncs run automatically. You can review what has been ingested, adjust scope, or revoke access at any time.
Requesting Changes¶
To change the scope of an integration, rotate credentials, or disconnect a system, contact your WorkDone implementation contact or support. Revocation performed on your side (removing app consent, disabling a service account, closing an SFTP account) takes effect immediately without any action from WorkDone.