Your data region

Choosing your data region

The sign-up at app.realizer.io shows where your organization's data will be kept before you create anything. You choose a region from those open to new organizations, and the organization stays in it: Realizer does not move your organization's data to another region without the written agreement of one of your Administrators.

Today, the region available is Canada: Microsoft Azure's Canada Central region, with geo-redundant backups in Canada East. More regions are planned.

The Create organization page shows the region you chose, so you can check it before you start. An Enterprise agreement can add a dedicated database or a dedicated region — talk to us.

What stays in your data region

Everything your organization puts into the service or receives through it is stored in your data region:

• cases of every register, their history, comments and correspondence, and the audit ledger;
• documents and recordings, their converted copies, release packages and exports;
• the personal information of requesters and everyone else in your cases;
• your members, roles and settings;
• search indexes, and the results AI produced;
• the e-mail the service sends for you (Azure Communication Services; for Canada, its data is stored in Canada);
• backups, geo-replicated to the paired Azure region in the same country — for Canada, from Canada Central to Canada East — so a copy survives the loss of one region and never leaves the country.

It is processed there too: malware scanning of every upload (Microsoft Defender for Storage), document conversion, media processing and accessibility checks (Realizer's workers in the same region), text recognition (Azure AI Document Intelligence), content search (Azure AI Search) and transcription (Azure AI Speech).

What crosses a region

None of your organization's data. Each region is a complete copy of the service, with its own database, files, search index, e-mail, workers, logs and backups. Each region keeps its own sign-in sessions; nothing of a session crosses a region.

The global entry at app.realizer.io keeps nothing. Its sign-up page shows where your data will be kept before the sign-up continues at your region's own address (for Canada, ca.app.realizer.io). When you sign in there, it asks each region, with your sign-in, which organizations you belong to, and sends you to yours. It sees your account's sign-in details only for that request, and stores no session, no sign-in token and no list of who belongs where. Its only cookie, __Host-ap-region, remembers the region you last chose (for example ca) for a year — nothing about you.

Two Microsoft services are global by design and handle each request on its way in: Microsoft sign-in (Microsoft Entra ID and Microsoft accounts), which checks your password and multi-factor authentication, and Azure Front Door, with its web application firewall, which carries your requests to your region from Microsoft's nearest point of presence.

AI Assist: outside your region only if you allow it

AI Assist is an add-on. Its Azure OpenAI models are provisioned in your data region, but in Canada, the region available today, Microsoft offers the current models only as Global deployments: Microsoft may process some prompts and answers in its other Azure regions worldwide.

• Off until an Administrator allows it. For each organization, AI Assist stays off until an Administrator reads a short, dated statement in Settings → Features & AI → AI Assist and allows it. The decision is recorded in your audit history and audit ledger, and can be withdrawn at any time.
• Nothing AI produces is stored outside your region. Cases, documents and the results AI produced stay in your data region. Microsoft does not use prompts or answers to train its models; its abuse monitoring keeps its own records under Microsoft's terms.
• Not affected: text recognition, content search and transcription are processed in your data region and need no permission.

What Realizer keeps about your account

Realizer's own records of the service — kept by Realizer in Canada — hold your organization's name and region, the name and e-mail address of the person who created it (your account contact for security and account notices), its plan, add-ons, trial and billing state, and counts and dates of its use: never the content of a case.

Paid plans are billed by Stripe. Your card, billing address and any tax number are entered on Stripe's own payment page and never reach AccessPoint or Realizer. Stripe processes billing in its own jurisdictions.

Service providers

• Microsoft hosts the service, signs people in, carries its e-mail and runs its AI services, under Realizer's agreement with Microsoft. It is the only service provider that processes your organization's data.
• Stripe processes billing details for paid plans — not your cases or documents.
• HubSpot holds Realizer's customer records (companies and deals) in its Canadian data centre in Montréal.

Realizer tells your Administrators by e-mail at least 30 days before a new service provider starts processing your organization's data. The privacy notice lists every provider and where it processes data.

How it is protected

• Each organization's data is kept apart at every layer: every row carries its organization, every query is filtered by it, and the database enforces the same rule.
• Encrypted in transit and at rest.
• Every uploaded file is scanned for malware; a flagged file cannot be opened, downloaded or released.
• Realizer's staff act on a whole organization only through logged operator commands inside the service's own environment — never through a web page.
• Realizer uses your data only to provide, secure and support the service. It does not sell it, share it for anyone else's purposes, use it for advertising or use it to train AI models.

Hosted AccessPoint is not certified or independently assessed. The privacy notice, the Terms of Service for Hosted AccessPoint and Realizer's privacy and security documentation describe how it protects your data, and Realizer answers reasonable written questions about them. Your organization decides whether these locations meet its own residency and procurement rules.

Questions: support@realizer.io. To report a vulnerability: security@realizer.io.