KoalaFix only ever works with the Microsoft 365 access the signed-in person already has — it can never reach anything they couldn't reach themselves. A short list of irreversible actions on your PC is refused outright; anything else that changes your computer pauses for a plain-English yes/no first, with a note on how to undo it. Your data stays onshore in Sydney.
KoalaFix has two parts: the app on your Windows PC, and a secure KoalaFix server in Sydney. The app does the diagnosing on your machine; the server is what connects to the AI behind the scenes.
What matters for you: none of KoalaFix's secret keys ever sit on your computer. They stay locked away on the server. So a lost or stolen laptop can't be used to run up AI charges or act as KoalaFix.
Everything the agent does is tied to the person who's signed in. It can never do anything in Microsoft 365 that that person couldn't already do themselves.
KoalaFix signs in as the user — it never gets its own master key to your Microsoft 365. It acts with exactly the same permissions the signed-in person already has, and nothing more.
Permissions are approved in two tiers. On first sign-in, every person approves a base set of read-only access plus the everyday permissions needed for diagnostics. Higher-level admin permissions are a separate approval that only your Microsoft 365 Global Admin can give, and they only ever switch on in organisations where that approval has happened.
Everyday access — every person, on first sign-in:
Admin access — only with Global Admin approval:
You can withdraw any of this at any time from the Microsoft 365 admin centre. The moment you do, the agent simply can't perform that action any more, and it tells the user so.
When KoalaFix needs to fix something on your Windows PC — restarting a stuck service, clearing a cache, repairing an Office app — it first sorts the action into one of three buckets. That decision happens before anything runs, and it settles whether the action is blocked, needs your OK, or is safe to do on its own.
A deliberately tiny set of irreversible actions KoalaFix will never take on its own. It stops and walks the user through these by hand instead.
Anything that changes your PC but can be undone. KoalaFix pauses and shows a plain-English yes/no that says what it's about to do and how to reverse it — nothing here happens without your explicit OK.
Read-only checks and a fixed list of known-safe fixes. These run without asking, because they can't harm anything.
When several actions are bundled together, KoalaFix pulls them apart and checks each one on its own — and the most cautious result wins, so a risky step can never be slipped in alongside a safe one.
IT and security teams can ask for the exact, full list of what's blocked, what needs a confirmation, and what runs automatically. We're happy to walk your team through all of it on a call.
KoalaFix installs from a signed Windows installer — signed with a Microsoft-issued certificate, so Windows recognises KoalaFix Pty Ltd as a verified publisher instead of warning you about software from an unknown source.
Onboarding is a guided walkthrough call with Oliver — included on every plan. During that call:
After the call, the rest of your team installs the signed app and signs in with their own work accounts. Each person approves their own everyday access on first sign-in. Enterprise customers get a dedicated onboarding session — we come in, map your setup, and get KoalaFix up to speed on your team.
Two services hold your data, and both sit in Sydney:
The only time anything leaves Australia is the AI request itself, which the server forwards on your behalf. The AI provider, Anthropic, processes each request in memory — it doesn't train on it and doesn't keep it. Their Data Processing Addendum is available on request.
Every connection in and out is encrypted.
KoalaFix is not SOC 2 certified today. KoalaFix Pty Ltd was registered on 16 March 2026 and the product is early-stage. We won't display a SOC 2 badge or an "in progress" sticker until we have an auditor's letter to back it up.
If SOC 2 status is a blocker for your procurement team, the onboarding call is the right place to tell us. We'd rather know early what compliance bar you need.
Security questions, procurement follow-ups, or "our compliance team needs X" — email us and we'll get back to you.