Overview
In Bizagi there are multiple ways to start a case. You can start cases manually from the Work Portal, use an external system through the Bizagi OData API, or define programmed jobs. With Triggers and Actions, you can automatically start cases based on the content of emails.
For example, if an email contains the word complaint, Bizagi can automatically start a case in the Claims and Complaints process. For more information about email triggers, refer to Triggers and Actions.
This article explains how Triggers and Actions are secured and describes the security measures and configuration practices that help protect the feature.
Security by design
The Triggers and Actions feature is covered by the security layer of the Bizagi Cloud Platform. Likewise, the architecture of the functionality offers data security, availability, and traceability. Moreover, Triggers and Actions rely on Office365 mailboxes and benefit from its security measures.
Security layer for Triggers and Actions
The security layer has two levels. The first level corresponds to the security layer of the Bizagi Cloud Platform, while the second level corresponds to the security features of the Office365 mailbox.
The Bizagi Cloud Platform security layer filters request and protects access by implementing:
•Next generation firewall. Offers IDS, IPS, and antimalware capabilities, while helping prevent leaks and protect network ports.
•Application gateway (includes a Web Application Firewall). Provides additional security at the web application level (which prevents SQL injection, cross-site scripting attacks, malicious files and other threats), while routing requests to the target environment and its authorized endpoint (performing load balancing as well).
Office365 mailbox includes antiphishing, antispam, and antimalware protection and it helps protect against malicious email attachments. If a message is detected as malicious, it is blocked and quarantined to prevent malicious emails from arriving at Bizagi.
Integration and Authentication
Customers do not need to set up any system integration or authentication between their email provider and Triggers and Actions. The mailbox is provisioned and managed by Bizagi.
Interaction between the BizagiMailer service and the Automation Service application is protected by OData authentication (OAuth 2) and authorization features. While a generic user is configured in Automation Services as the principal of the OAuth application, you can use a user with permissions restricted to case creation operations.
Data security
•Data is encrypted at rest and in transit, using strong encryption protocols, and technologies that include Transport Layer Security/Secure Sockets Layer (TLS/SSL) and Advanced Encryption Standard (AES). Use encryption in transit for messages delivered from your SMTP system to Bizagi. Data at rest is encrypted using Office365 Service Encryption.
•To comply with data regulations, all service components are deployed in the same Azure region as the Automation Service.
•Bizagi retains data as required to support service operation.
•Once an email is processed by the Triggers and Actions feature, it is stored in a dedicated Processed storage area and is not available for processing again.
•Email messages are not backed up.
•The Triggers and Actions mailbox is outside the scope of the disaster recovery service.
•Emails are retained for 30 days for troubleshooting purposes. After 30 days, they are permanently removed.
Availability
Bizagi manages and monitors the service through alerts and makes the necessary adjustments to ensure service availability.
Traces
The Tracing menu in Management Console includes a section dedicated to Triggers and Actions traces. You can use these traces to evaluate how Triggers are operating, identify completed actions, and troubleshoot issues.
These traces will look like the one below:
Security for your processes
To help secure your Triggers and Actions implementation, consider the following recommendations:
Use an email box from your domain
Use a mailbox from your organization to receive email messages. Never use the email address of the BizagiMailer service to receive notifications directly. Using your organization's mailbox helps ensure that emails are subject to your configured security policies and reduces the risk of malicious messages reaching Triggers and Actions.
Setup forwarding rules on your email box
Configure rules to automatically forward messages to the Bizagi-provided mailbox, from existing support mailboxes to help ensure that email messages have been filtered using your provider's security technologies and policies.
Triggers and Actions configuration in Bizagi Studio
Set up the sender domains that will be considered by the Trigger. If this property is empty, the trigger considers all domains. Otherwise, if you register one or more domains, for example, mycompany.com, only emails coming from that domain are considered. Configure at least one sender domain. For more information, refer to Triggers and Actions configuration in Bizagi Studio.
Last Updated 10/2/2026 11:35:43 AM