No investigation team works in one application. There is a ticketing system, a case or matter management system, a reporting obligation, and a set of internal steps that happen every single time a case opens or closes.
Integrations connect the workspace to those systems and run your own automation flows.
The repetitive half of investigative work
Most of what an analyst does twice a day is not analysis: opening a case from a ticket, notifying a reviewer, exporting a report to the place the client expects it, archiving what must be archived and removing what must be removed.
Automating those steps has two effects. The obvious one is time. The less obvious one is consistency — a process that runs the same way every time is a process you can describe to an auditor.
Automation without giving up residency
The point of device zero is that the case file lives on your machine. Integrations respect that: they move what you decide to send, when you decide to send it. Connecting a ticketing system does not turn the case file into someone else's copy.
Flows you define
The flows are yours. Which events matter, what should happen, who gets told, what leaves the workspace and in what form — these are policy decisions in your organisation, not defaults imposed by a vendor.
Where it pays off
Intake. A request becomes a scoped case without retyping it.
Review. The right person is asked at the right moment instead of being chased.
Closure. Reports are delivered and retention obligations run on a schedule rather than on someone's memory. See provenance and retention.
Frequently asked questions
Can it connect to our existing case management system? That is the intent: the workspace fits into your process rather than replacing it wholesale.
Does automation bypass review? No. Approvals stay where you put them — automation moves the work between steps, not past them.
Does connecting a system copy the case out of my environment? Only what your flow sends, when it sends it.
Read next: Plugins or device zero.