Security might not be the most exciting topic in the world of intranets and digital workplaces – but it's arguably one of the most important.
When you're choosing an intranet or digital workplace platform, security isn't just about ticking boxes on a compliance checklist. It's about trust – trust that your company information is protected, that your employees' data is safe, and that your organization won't be exposed to unnecessary risk.
I wanted to share how we approach security at Fresh and what organizations should be looking for when evaluating their digital workplace security.
Built on Microsoft 365's security foundation
Fresh is built entirely on Microsoft 365, which means we inherit enterprise-grade security capabilities from day one. This isn't just convenient – it's strategic. Microsoft invests billions in security infrastructure, threat intelligence, and compliance that would be impossible for individual software vendors to replicate.
What this means in practice:
- Data residency and sovereignty – Your data stays within your Microsoft 365 tenant, in your chosen geographic region
- Identity and access management – Seamless integration with Entra ID (formerly known as Azure AD), conditional access policies, and multi-factor authentication
- Encryption – Data encrypted at rest and in transit using Microsoft's enterprise standards
- Threat protection – Benefit from Microsoft's global threat intelligence and security monitoring
Compliance and certifications
Through our Microsoft 365 foundation, and backed by Advania’s compliance certifications, Fresh operates within a framework that maintains major compliance certifications including ISO 27001, SOC 2, GDPR compliance frameworks, and industry-specific standards like HIPAA (where applicable).
For organizations in regulated industries, this means your intranet can align with your broader compliance requirements without requiring separate security assessments or frameworks.
Security features built into Fresh
Beyond the Microsoft 365 foundation, Fresh includes security considerations in how the platform works:
- Granular permissions – Control who can see, edit, and publish content at a detailed level
- Audit logging – Track content changes, access patterns, and user activity
- Secure external sharing – When you need to share content outside your organization, do it with controls and visibility
- API security – Integration points are secured and authenticated
- Regular security updates – Security patches and updates are provided regularly
Our approach to incidents and threats
Security isn't a set-it-and-forget-it exercise. We maintain:
- Proactive monitoring and threat detection through Microsoft's security tools
- Regular security assessments and penetration testing
- A defined incident response process
- Transparent communication with customers if issues arise
- Continuous improvement based on the evolving threat landscape
What should you be asking your intranet provider?
If you're evaluating platforms or reviewing your current setup, here are some questions worth asking:
- Where is my data stored and who has access to it?
- What compliance certifications do you maintain?
- How do you handle security incidents?
- What's included in the platform versus what requires additional security tools?
- How do updates and patches get deployed?
- Can the platform integrate with our existing security infrastructure?
The bottom line
Security should be embedded in your digital workplace platform, not bolted on as an afterthought. At Fresh, we believe transparency about our security approach helps organizations make informed decisions about their digital workplace, with the intranet playing a central role as a trusted entry point to content, communication, and collaboration.
I've written an article on this topic here if you want to dive deeper:
Have questions about intranet security or want to discuss how this applies to your organization's specific requirements? Drop a comment below or feel free to reach out directly.
