Skip to content

Security and Access

WorkDone products are built with strong defaults: invitation-only provisioning, role-based access control, organization-scoped tenancy, and passwordless sign-in. This guide covers the practices on your side that keep a deployment secure over time: who gets access, how much, for how long, and how credentials and outputs are handled.

For the platform's own security posture, see Security and Compliance.

Assign roles by least privilege

Corporate Memory has four roles: Admin, Management, Automation, and Member. Assign each user the lowest role that covers their actual work:

  • Default to Member. Members get Copilot and the Vision Dashboard, which is what most users need.
  • Reserve Admin for the few people who genuinely manage users, organization settings, and the approval queue. Admin should be a short, known list, typically two or three people.
  • Use Management and Automation for what they're for (review/approval workflows and automation operations respectively), not as a convenience upgrade from Member.
  • Revisit roles when jobs change. A role granted for a project should not outlive the project.

See Managing Users for the mechanics of assigning and changing roles.

Keep invitation hygiene tight

Access to WorkDone products is invitation-only; there is no public sign-up. That makes the invitation step your provisioning control, so treat it like one:

  • Invite work email addresses only. Never invite personal mailboxes, even temporarily.
  • Decide the role before you send the invitation, not after the person is already in.
  • Track who you've invited. Pending invitations that were never accepted should be revoked, not left open.
  • One person, one account. Shared accounts break accountability and make offboarding impossible to do cleanly.

Review access quarterly

Access rot is gradual and invisible until you look. Put a quarterly access review on the calendar for each WorkDone product your organization uses:

  1. Export or list your current users and their roles.
  2. For each user, confirm they are still employed, still in a role that needs access, and still hold the right role.
  3. Downgrade or remove anyone who fails the check, and revoke stale pending invitations.
  4. Record that the review happened and what changed; your own auditors will thank you.

Fifteen minutes per quarter is usually enough for most organizations, and it is the single highest-value habit in this guide.

Deactivate leavers promptly

Removing a departing user's WorkDone access belongs in your standard offboarding checklist, executed the day they leave, not at the next quarterly review.

  • Remove the user from the organization in the portal (see Managing Users).
  • Don't rely on email deactivation alone. Removing the mailbox blocks new sign-in codes, but removing the account is what actually revokes access and keeps your user list truthful.
  • Cover role changes too. An internal transfer out of a workflow-operations role should lose the Automation role even though they keep their account.

Scope integration service accounts narrowly and read-only

Every integration (SharePoint, Google Drive, Teramind, your business systems) should run under a dedicated service account with the minimum access it needs:

  • Read-only wherever the integration supports it. Document ingestion and analytics feeds never need write access.
  • Scope to the designated sources, not the whole tenant: the specific SharePoint sites and Drive folders you chose in Knowledge Base Curation, not "all sites."
  • Never use a personal account for an integration. People leave; the integration shouldn't leave with them.
  • Rotate credentials on your normal schedule and revoke immediately if you suspect exposure; revocation on your side cuts off access without waiting on WorkDone.

Protect exported files and deliverables

Reports exported from WorkDone products (Accelerator assessment reports, per-section data exports, dashboard extracts) have no protection at all once saved as Word, PDF, or CSV files. So:

  • Store exported files in access-controlled locations, and strip or redact them before sharing beyond the intended audience.
  • Don't post deliverables in broad channels (all-hands chat, wikis, ticketing systems with wide visibility).
  • Treat the assessment identity key with particular care. It is delivered separately from the report, to designated recipients only, precisely so the anonymized report can circulate while the mapping cannot; don't recombine them in a shared location.

Handle one-time passcodes correctly

Where WorkDone sign-in is passwordless, you enter your email and receive a one-time passcode (OTP). Two rules cover almost everything:

  • Never share a code with anyone: not a colleague, not anyone claiming to be WorkDone. WorkDone will never ask you for a sign-in code by phone, chat, or email.
  • Codes are single-use and expire within minutes. If a code arrives late or is rejected, just request a new one; don't hunt for old codes in your inbox.

If you receive sign-in codes you didn't request, someone is entering your email address; you can ignore the codes (they're useless without your mailbox), but report repeated occurrences to support.

The mailbox is the credential

With passwordless sign-in, access to the user's mailbox is access to the product. Make sure everyone who signs in this way has multi-factor authentication on their email account.