Security, Privacy & Compliance
Security is built into how WorkMesh works.
WorkMesh is designed around strong identity, Business-scoped access, tenant separation, server-side authority, traceable activity, governed integrations and privacy-aware operation. The same authority model extends to APIs and compatible AI assistants so connected tools do not become a shortcut around normal WorkMesh permissions.
WorkMesh controls are designed with recognised information-security, cloud-security, application-security, privacy and AI-governance frameworks in mind. We distinguish standards alignment from independent certification and do not claim certifications that have not been earned.
WorkMesh security controls
Controls across identity, access, data boundaries, integrations and change.
Security is applied through the platform architecture and server authority model rather than relying on hidden browser controls or a single perimeter defence.
| Security feature | What WorkMesh does | Relevant standards / frameworks |
|---|---|---|
| Multi-factor authentication | Supports WorkMesh App and TOTP second-factor authentication with governed recovery, device and session controls rather than relying on password-only access. | ISO/IEC 27001:2022 NIST CSF 2.0 OWASP ASVS 5.0.0 |
| Federated identity | Supports Microsoft Entra sign-in at Business level while preserving WorkMesh membership, permissions and Business authority inside the platform. | ISO/IEC 27001:2022 NIST CSF 2.0 OWASP ASVS 5.0.0 |
| Business-scoped access | Users operate inside explicit Business membership and authority boundaries. Application access, roles, teams and object authority are evaluated so access can be limited to the work a person is authorised to perform. | ISO/IEC 27001:2022 NIST CSF 2.0 OWASP ASVS 5.0.0 |
| Tenant isolation | Business separation is a core platform security boundary, including database-per-Business tenancy in the WorkMesh architecture. | ISO/IEC 27001:2022 ISO/IEC 27017:2026 NIST CSF 2.0 |
| Server-side authorisation | Permissions are enforced by the server across Business, application, System, record, workflow and Field scope. Hiding a control in the browser is never treated as the security boundary. | OWASP ASVS 5.0.0 OWASP Top 10:2025 ISO/IEC 27001:2022 |
| Role, team and record-level controls | Access can be governed by Business Roles, System Roles / Teams and record-level rules so specialist or sensitive processes can remain restricted without isolating the whole platform. | ISO/IEC 27001:2022 NIST CSF 2.0 OWASP ASVS 5.0.0 |
| Audit history and traceability | Supported WorkMesh records, workflows, Actions and security-relevant activity retain governed history so organisations can understand what changed, who acted and how work reached its current state. | ISO/IEC 27001:2022 NIST CSF 2.0 ISO/IEC 27701:2025 |
| Secure APIs and integrations | External integrations use Business-owned connections, explicit scopes and governed grants with credential rotation and revocation controls rather than unrestricted platform-wide access. | ISO/IEC 27001:2022 ISO/IEC 27017:2026 OWASP ASVS 5.0.0 |
| Backup and retention | WorkMesh supports daily, weekly and monthly backup retention for up to seven years while the applicable subscription is maintained, supporting recovery, continuity and record-retention requirements. | ISO/IEC 27001:2022 NIST CSF 2.0 |
| Controlled software change | Material changes are tied to exact source identities, isolated validation, rollback evidence and explicit deployment verification so change remains traceable and reviewable. | ISO/IEC 27001:2022 NIST CSF 2.0 OWASP ASVS 5.0.0 |
| Governed AI and Agent access | Compatible AI assistants connect through delegated user authority, approved OAuth scopes and a bounded WorkMesh tool catalogue. AI access does not create a separate unrestricted administration path. | ISO/IEC 42001:2023 NIST AI RMF 1.0 NIST AI RMF Generative AI Profile |
Security and cloud standards
Mapped to recognised frameworks used to assess modern cloud applications.
These references describe the standards and frameworks that are relevant to the controls WorkMesh implements. They are not statements that WorkMesh holds an independent certification unless we explicitly say so.
| Standard / framework | Why it is relevant | WorkMesh focus |
|---|---|---|
| ISO/IEC 27001:2022 | International information-security management system requirements. | Identity, access control, security governance, change control, supplier/integration risk, auditability and information protection. |
| ISO/IEC 27017:2026 | Cloud-specific security controls and guidance for cloud customers and providers. | Cloud responsibility boundaries, tenant separation, privileged access, service administration and secure cloud operation. |
| ISO/IEC 27018:2025 | Guidance for protecting personally identifiable information in public-cloud processing. | Privacy-aware cloud handling, accountability, transparency and protection of personal information. |
| NIST Cybersecurity Framework 2.0 | Risk-based cybersecurity outcomes across Govern, Identify, Protect, Detect, Respond and Recover. | Governed security decisions, access protection, traceability, response readiness and recovery. |
| OWASP ASVS 5.0.0 | Verification requirements for web-application technical security controls. | Authentication, session management, access control, validation, API security and server-side enforcement. |
| OWASP Top 10:2025 | Current awareness baseline for the most significant classes of web-application security risk. | Broken access control, security misconfiguration, supply-chain risk, cryptographic failures, injection, insecure design, authentication, integrity and logging. |
Privacy and data protection
Privacy is treated as a governance and product-design concern.
WorkMesh is operated from Australia and is designed to support organisations handling personal information under applicable privacy obligations. Legal obligations depend on the organisation, jurisdiction, data and use case, so platform controls support compliance rather than replacing the customer's own legal responsibilities.
| Privacy requirement / framework | What it covers | How WorkMesh supports the principle |
|---|---|---|
| Australian Privacy Principles Privacy Act 1988 (Cth) |
Transparency, collection, use/disclosure, direct marketing, cross-border disclosure, data quality, security, access and correction. | Published privacy/cookie information, consent controls for optional public analytics/marketing, restricted Business authority, server-side access controls, traceable activity and privacy-request channels. |
| APP 11 — Security of personal information | Reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. | MFA, Business and record authority, tenant separation, governed integrations, server-side permission checks, auditability and controlled recovery practices support this security objective. |
| ISO/IEC 27701:2025 | Privacy Information Management System requirements and guidance for controllers and processors of PII. | Privacy governance, authority boundaries, auditability, data-handling transparency and controlled processing are considered alongside the information-security model. |
| ISO/IEC 27018:2025 | Protection of PII in public-cloud services acting as PII processors. | Cloud privacy principles are reflected in Business isolation, controlled access, auditability and privacy-aware operation. |
| EU GDPR — where applicable | Lawfulness/fairness/transparency, purpose limitation, data minimisation, storage limitation, accuracy, integrity/confidentiality and accountability, together with individual data rights. | WorkMesh provides security, access, audit and configurable retention foundations that can support a customer's GDPR obligations. Applicability, lawful basis, retention settings and data-subject response obligations remain dependent on the customer's processing context. |
| Privacy by design and by default | Building privacy safeguards into processing and restricting access/data use to what is necessary by default. | Business-scoped authority, purpose-specific Systems, granular roles and record rules, server-side enforcement and consent-gated optional public tracking support a least-access approach. |
AI governance
AI works inside WorkMesh authority — not around it.
WorkMesh is designed for AI-enabled work without creating a second permission system for AI assistants.
A compatible AI assistant connects as an authorised WorkMesh user rather than as an anonymous platform-wide agent.
OAuth scopes limit which classes of WorkMesh capability a connected assistant may request.
WorkMesh still evaluates current Business, System and record authority when an Agent request is executed.
Sensitive capabilities remain governed by the product's normal authority and lifecycle rules rather than being automatically granted to AI.
| AI governance reference | Relevance to WorkMesh |
|---|---|
| ISO/IEC 42001:2023 | Provides a management-system framework for responsible AI governance, risk, accountability, transparency and continual improvement. |
| NIST AI RMF 1.0 | Provides a voluntary risk-management framework for trustworthy and responsible development, deployment and use of AI systems. |
| NIST AI RMF Generative AI Profile | Extends AI risk-management guidance for the particular risks created by generative AI use cases. |
What standards alignment means
Detailed controls without overstating assurance.
Standards and regulatory references on this page show where implemented WorkMesh controls align with recognised security, privacy, cloud and AI-governance concepts. They help customers understand the design basis and assess WorkMesh against their own requirements.
Alignment is not the same as independent certification, attestation or a guarantee of regulatory compliance. WorkMesh will only claim a certification or independent assurance when that specific certification or assurance has actually been achieved.
“The right question is not whether a logo is on the website. It is whether identity, authority, isolation, privacy and traceability are actually built into the product.”
WorkMesh security principleSecurity review
Need to assess WorkMesh against your organisation's security or privacy requirements?
We can walk through identity, access, tenant separation, integrations, AI authority, privacy controls, backup/retention and the standards relevant to your environment.