English

What Realizer provides and what your organization is responsible for when it uses AccessPoint — jurisdiction content and computed outputs, AccessPoint for Microsoft 365, Hosted AccessPoint and the AccessPoint Training Lab

Last updated: November 10, 2026 by Steve

Customer Responsibilities

This page sets out what Realizer provides and what your organization remains responsible for when it uses AccessPoint: the jurisdiction content and the figures AccessPoint computes from it, AccessPoint for Microsoft 365 running in your own tenant, Hosted AccessPoint run by Realizer in Canada, and the AccessPoint Training Lab for training providers. It complements the Technical Architecture, the GC Security Controls Reference and the GC Privacy Impact Assessment. The binding terms are in your agreement with Realizer — for the hosted service, the Hosted AccessPoint terms.

What Realizer Provides

  • Jurisdiction packs. Request types, deadlines and day bases, calendars and holidays, fees and waivers, exemption and exclusion catalogues, extension reasons, breach-notification rules, complaint and appeal types, letter templates, playbooks, assessment templates, readiness obligations, statistical-return templates and training content for each jurisdiction. Each pack is a starting point built from public information about the legislation — legislation, gazettes and regulator guidance — as of the version shown in Settings > Jurisdiction packs, with its changes listed in the pack's change notes. It is not legal advice.
  • Computed outputs. Due dates, statutory-return figures, breach-notification clocks, and readiness and program-position states, which AccessPoint calculates from your records under the rules in the packs you applied.
  • AI Assist drafts. Suggestions and drafts, always for a person to decide on. In AccessPoint for Microsoft 365 they come from your own Azure OpenAI resource; in Hosted AccessPoint, from Azure OpenAI models Realizer provisions in Canada, once your Administrator allows it.
  • The software and its releases. A secure development life cycle; signed releases with checksums and software bills of materials; security advisories and vulnerability fixes; and the publisher services a Microsoft 365 deployment uses (license validation, jurisdiction packs, the Teams relay, setup pages and release files).
  • Hosted AccessPoint (2.6.0). The same software run by Realizer in Canada, holding your organization's data as its service provider.
  • The AccessPoint Training Lab. The simulation and workspace in which a training provider runs its classes, with Realizer as the provider's processor.

What Your Organization Is Responsible For

Whichever edition you use, your organization is responsible for:

  • Confirming the pack content you apply against the current law, the regulator's current instructions and your own obligations, and adjusting it in Settings where it does not match. Every pack item is editable, and re-applying a pack never overwrites an item you changed (unless you choose and confirm a full overwrite). Your legal counsel validates and adjusts the content.
  • Checking every computed output — due dates, statutory returns, notification deadlines, readiness — against your own records and the regulator's instructions before you submit it or rely on it.
  • Deciding on every AI suggestion. AI output is never a legal determination: it is a suggestion, an editable draft or a read-only answer for a person to check.
  • Your own compliance. AccessPoint is a case-management tool, not legal advice, and using it does not make an organization compliant.

Where AccessPoint Says So

Where What it shows
Settings > Jurisdiction packs A notice on every view that packs are general information, not legal advice
Applying a pack A required acknowledgement, every time, that the pack is general information prepared from public sources and that your organization must confirm its content before relying on it; Apply stays disabled until it is ticked. The applied-packs record keeps who applied which version and when
Reports > Statistical reports A notice above every template's output that it was prepared automatically from your records using your packs' rules. Files in the regulator's own format are left unchanged, so a submission never carries text the regulator did not ask for
Privacy program (Overview, Position, Year, Discovery) The same notice, collapsed to its first line, and a line in the Excel and PDF exports
AI Assist Labels such as AI-generated — review before use, and a one-time responsible-AI acknowledgement by an Administrator
Accessibility conformance report A disclaimer that it is a self-assessment, not a certification

The wording appears in all eleven product languages.

AccessPoint for Microsoft 365

AccessPoint for Microsoft 365 runs in your own Azure subscription and Microsoft 365 tenant, and Realizer has no runtime access to it. Responsibility is shared four ways:

Party What it carries
Microsoft Datacenters, hardware and platform networking; the App Service, SQL, Storage, Key Vault, Container Apps, Front Door and AI platforms; Entra ID and Microsoft 365
Your organization Its authorization decision, categorization and risk acceptance; policies, personnel, training and its own sites and devices; Entra ID (MFA, Conditional Access, account lifecycle, privileged roles); the deployment choices (region, network isolation, malware scanning, alerts, log retention, keys, backups); role design and assignment inside AccessPoint; retention schedules; monitoring and incident response for its deployment; applying releases
The product (AccessPoint as deployed) Application authentication and authorization, tenant isolation, PII minimization, the audit trail and tamper-evident ledger, encryption settings, a secure-by-default template, the retention engine and disposal, malware and release gates, input validation
Realizer, as publisher The secure development life cycle and release integrity; vulnerability handling and security advisories; operating its publisher services securely; telling customers about incidents in those services

The Deployment Guide and the GC Security Controls Reference list the deployment choices that are yours. To receive Realizer's security advisories, register and confirm your security contacts in Notification Contacts, and keep your account contact current.

Hosted AccessPoint

In Hosted AccessPoint, Realizer runs the service and keeps your organization's data in its Azure subscription in Canada Central, as your service provider. What your organization would carry for its own deployment — the deployment choices, network, logging and alerting, backup and recovery, applying releases, key management and incident response for the environment — is Realizer's. See Hosted AccessPoint for how the service works.

Your organization stays responsible for its program and its data:

  • What it collects and why. Its own collection notices to requestors and others (forms, letters, its website), its answers to requests about the personal information it holds, and its own legal authority for each case it records.
  • Its own assessment of using the service. A privacy impact assessment of using a hosted service (see the GC Privacy Impact Assessment), and confirming that storage in Canada Central, Microsoft's global sign-in and edge service, Stripe's billing and — if it allows AI Assist — AI processing that may take place outside Canada meet its own residency and procurement rules.
  • Who is a member. Inviting only the people who should work in AccessPoint, giving them only the roles they need, and removing those who leave — the hosted service has no link to your directory, so it does not notice a departure by itself. Choosing Who can join (work or school accounts of your own Microsoft tenants only) and the sign-out times in Signing out. Members' Microsoft accounts are protected by their own organization's settings, or by the person's for a personal account.
  • Keeping an Administrator who reads AccessPoint's e-mail. Trial reminders, the move to the Free plan and purge warnings go only to the organization's active Administrators.
  • Keeping the account contact current. It is the address of the person who created the organization, unless you ask Realizer (support@realizer.io) to change it, and it is where Realizer sends security and account notices.
  • Its e-mail. The Reply-To address it confirms, the letters and notices it sends from the shared address accesspoint@notices.realizer.io, and staying within the service's e-mail budget.
  • AI Assist. Deciding whether to allow AI Assist, after reading the statement in Settings, and withdrawing that permission if its position changes.
  • Its records schedule. Setting retention periods and running Retention Review as it would in its own deployment, and placing a preservation hold on any case it must keep while a matter is open.
  • Its own copy. Downloading its data (Download all of your organization's data, Settings > Subscription) before it leaves, when it is warned that an inactive Free organization will be removed, or whenever its own rules need a copy. Realizer deletes an organization that leaves once a complete export is recorded, and removes an inactive Free organization after the warnings; it does not keep a copy for the organization afterwards. Realizer's backups exist to recover the service after an incident, not to restore records an organization deleted.
  • Its plan. A lapsed subscription makes the organization read-only: it renews or chooses a plan to work its cases again.
  • Training. Telling its staff never to type real personal information into Lab mode's training cases.

If Realizer confirms a security incident that has affected, or likely affected, your organization's data, it tells your Administrators and account contact by e-mail, as the Hosted AccessPoint terms set out.

The AccessPoint Training Lab

In the AccessPoint Training Lab (learn.realizer.io), Realizer runs the simulation and the training provider's workspace as the provider's processor. Nothing passes between the Lab and any organization's AccessPoint. The training provider is responsible for:

  • Its course material. It owns it, keeps its source, and must hold the rights to everything it uploads. Realizer keeps the material in the Lab's private storage, never in its source code, logs or telemetry, and its staff reach it only through an audited support view.
  • Fictional content only. Scenarios, records and recordings must be fictional, with no real person's information. The Lab checks scenarios and AI drafts for real-looking addresses and identifiers, but the provider decides what it publishes.
  • Its learners. Telling learners who runs the class and how to reach the provider; choosing for each class whether to ask for an e-mail address (a class code and a name, the default, keeps the least); keeping the class list; answering learners' requests; choosing how long learner data is kept after a class closes (7 to 90 days, 30 by default) and exporting what it needs before then.
  • Certificates. Issuing a certificate of completion only with the learner's agreement: anyone with its link can verify it, and it is kept until the provider deletes it.
  • Its members. Inviting only its own staff and contract instructors, removing those who leave, and keeping an active workspace administrator. An instructor gives a learner a new resume code only at the learner's request: the code lets the instructor continue as the learner, so its use is audited and the learner is told.
  • AI drafting. Switching it on only by agreement with Realizer, and reviewing every draft before it reaches a learner.
  • The provider agreement, which records Realizer's processor terms and what the provider agreed to.
←
Previous Building a Repository Connector
Next User Guide
→