AccessPoint vs. ATIPXpress

The short answer

ATIPXpress (with FOIAXpress, its long-established US federal sibling) is a dedicated cloud ATIP request-processing system, and it's the successor many Government of Canada institutions procured when AccessPro was declared legacy. It does request tracking well. The structural differences are scope and residency: ATIPXpress manages access requests in the vendor's cloud, while AccessPoint runs the whole access-and-privacy mandate — requests, PIAs, AIAs, breaches, complaints, risk — inside your own Microsoft 365 and Azure tenant, with flat published pricing instead of a quote.

What is ATIPXpress (and its US sibling, FOIAXpress)?

ATIPXpress comes from AINS, a Maryland company whose FOIAXpress product has processed US federal FOIA work for over two decades. Both run on AINS's eCASE case management platform, sold as two products through two channels: in Canada, ATIPXpress is delivered through the reseller iPSS, with its own training site and versioned documentation. AINS rebranded as OPEXUS in January 2023, and in January 2025 OPEXUS merged with Casepoint under a majority investment from Thoma Bravo. The OPEXUS brand is now being retired — opexustech.com redirects to casepoint.com — and ATIPXpress is marketed from Casepoint's site as a cloud solution for Canadian ATIP teams.

In Canada, ATIPXpress's momentum has come from the AccessPro retirement: with APCM designated a Government of Canada legacy application effective June 2023, a TBS-coordinated replacement effort saw institutions including Correctional Service Canada, the Public Service Commission, and CIRNAC procure ATIPXpress, with deployments landing through 2025-26. If you work in federal ATIP, it is the incumbent request-tracking path.

The honest comparison, then, isn't about whether ATIPXpress can process a request — it can. It's about what a modern access office actually runs: the same team increasingly owns privacy impact assessments, algorithmic impact assessments, breach response, and complaints. And it's about architecture — whether your most sensitive records (the very documents under access review) should sit in a vendor's multi-tenant cloud, or stay inside the Microsoft 365 environment your institution already secures and audits.

ATIPXpress fact sheet

Product: ATIPXpress — the Canadian ATIP configuration of the AINS eCASE platform; FOIAXpress is its US federal sibling
Vendor lineage: AINS → OPEXUS (Jan 2023) → merged with Casepoint, majority investment by Thoma Bravo (Jan 2025); the OPEXUS brand is being retired
Canadian channel: Delivered in Canada through the reseller iPSS Inc.
Deployment: Vendor-hosted cloud SaaS
Market: US federal FOIA; Canadian federal ATIP — the procured successor to AccessPro at several institutions
Status: Actively sold (marketed via casepoint.com)

Sources

ATIPXpress and AccessPoint, side by side

	ATIPXpress	AccessPoint
Scope	ATIP/FOI request processing and redaction	Access requests plus PIAs, AIAs, breach response, complaints, and a privacy risk register
Where your data lives	Vendor's cloud	Your own Microsoft 365 and Azure tenant — no third-party cloud
Records collection	Documents uploaded into the vendor system	Pulled straight from SharePoint, OneDrive, Outlook, and Teams — plus Teams chats, OneNote, and Copilot history
Vendor stability picture	Two ownership changes since 2023 (OPEXUS rebrand; Casepoint merger under Thoma Bravo)	Independent Canadian vendor with a public roadmap; your exit is a one-click export either way
Jurisdiction rules	Configured for ATIP; per-implementation setup	106 jurisdiction packs — federal, provincial, US, EU, UK, and more
AI	Vendor-cloud AI capabilities	Optional AI Assist on Azure OpenAI inside your own tenant's subscription — prompts never stored, nothing trains outside models
Security review	Full vendor-cloud assessment (data residency, subprocessors, egress)	Shorter — nothing is vendor-hosted; your existing M365/Azure controls govern it
Pricing	Per-seat / call for quote	Flat annual, published on the site, no per-user fees

Competitor capabilities vary by product edition and configuration; this table reflects each product's public positioning as of August 2026.

Where ATIPXpress fits

A fair comparison cuts both ways — ATIPXpress is a reasonable choice when:

Your institution has already procured it through the TBS-coordinated AccessPro replacement and the deployment is underway — switching mid-stream rarely pays.
Your mandate genuinely stops at request processing, and your security posture accepts vendor-cloud residency for records under review.
You're a US federal agency deep in the FOIAXpress ecosystem where its 25-year FOIA specialization and installed base carry real weight.

Where AccessPoint differs

Records never leave your tenant The documents under access review are often the most sensitive your institution holds. AccessPoint processes them where they already live — your Microsoft 365 and Azure environment — instead of copying them into a vendor's cloud.

One platform for the whole office PIAs, AIAs, breach notification, complaints, and risk don't live in spreadsheets beside the request tracker — they run on the same platform, the same identity, and the same hash-chained audit ledger.

Public flat pricing, procurable in minutes Every tier is on the website, billed through the Microsoft marketplace on your existing invoice — no call-for-quote cycle, no per-user math, and a 30-day free trial in your own tenant.

AI inside your boundary Drafting, triage, redaction suggestions, and Ask AccessPoint run on Azure OpenAI deployed in your own tenant's subscription — every output is a suggestion a person decides on, and nothing leaves your tenant.

Migrating from ATIPXpress to AccessPoint

Coming from ATIPXpress — or leaving AccessPro and weighing both destinations? AccessPoint imports historical caseloads from any system that can produce a spreadsheet.

Export your caseload to Excel using the system's reporting — request registers, requestor lists, and key dates are enough to start.
Download AccessPoint's import template from Settings → Data import & export; it's generated with your tenant's own type codes, and old case numbers persist as legacy references.
Upload and validate: a per-row report shows created / skipped / errors before anything imports, and re-running a corrected file is always safe.
Stage documents in the migration-staging container in your own Azure storage, listed on the Documents tab with optional hash verification.
Import in the background — records arrive historical, with no notifications, no recomputed deadlines, and Imported provenance in the audit ledger.

The Export tab produces the same workbook the importer accepts, so you can rehearse the whole migration against a test tenant before committing.

Plan your migration → · Data Import & Export guide · Migration & onboarding services

Questions people ask about ATIPXpress and AccessPoint

How is AccessPoint different from ATIPXpress?

Two structural differences. Scope: ATIPXpress is a dedicated access-request processing system; AccessPoint runs access requests plus privacy impact assessments, algorithmic impact assessments, breach notification, complaints, and a privacy risk register on one platform. Residency: ATIPXpress hosts your case data in the vendor's cloud; AccessPoint deploys into your own Microsoft 365 and Azure tenant, so the records under review never leave your control. AccessPoint also publishes flat annual pricing rather than quoting per seat.

Who owns ATIPXpress now?

ATIPXpress was built by AINS, which rebranded as OPEXUS in January 2023. In January 2025, OPEXUS announced a merger with Casepoint backed by a majority investment from private-equity firm Thoma Bravo; the combined company currently operates as Casepoint + OPEXUS, and ATIPXpress is marketed from Casepoint's website.

Our institution is replacing AccessPro. Isn't ATIPXpress the standard path?

It's the incumbent path for several federal institutions via the TBS-coordinated replacement, and if your deployment is already underway, finishing it may be the right call. If you're still deciding, it's worth asking the wider question: a replacement cycle is the one moment you can consolidate the whole mandate — requests, assessments, breaches, complaints, risk — instead of replacing one request tracker with another and leaving the rest of the office in Word and Excel.

Can we import from ATIPXpress into AccessPoint?

Yes. Any report you can export to Excel maps into AccessPoint's tenant-generated import template — cases keep their old numbers as legacy references, requestors import alongside, and documents stage through your own Azure storage with optional hash verification. Validation runs before anything imports, and re-runs are always safe.

Does 'in your own tenant' actually make the security review shorter?

Usually, yes — because the questions that consume vendor-cloud assessments largely disappear. There's no vendor data residency to evaluate, no subprocessor list, and no cross-border transfer of case records: AccessPoint's backend deploys from a Bicep template into your own tenant's Azure subscription, authenticates through your Entra ID, and is governed by the Defender, Sentinel, and Purview tooling you already run. Our security page documents exactly what deploys and what the publisher can see — which is: your data, never.

Competitor information on this page is drawn from public sources — vendor websites, government reports, and press coverage — and was last reviewed in August 2026. Products evolve, and a comparison is never the whole story: capabilities vary by edition and configuration. Spot something out of date? Tell us and we'll correct it.