Your tenant. Your data. We never touch it.
The most important security control in AccessPoint isn't something we do — it's where it runs.
AccessPoint installs entirely inside your own Microsoft 365 and Azure tenant. Every request, document, assessment, incident, and audit record lives in your environment and never leaves it. The publisher has no runtime access to your data — there is no vendor cloud to breach, and no cross-border transfer to manage. You own and control the environment it runs in, including the Azure resources — billed to you directly by Microsoft (typically around $175/month), with no vendor markup.
Security posture
AccessPoint is built on the identity, encryption, and access controls your organization already runs — and hardened by default.
Microsoft Entra ID authentication
No new passwords or app-specific accounts. Users sign in with your existing Microsoft Entra ID; your MFA and Conditional Access policies apply in full.
Role-based access & a PII firewall
Granular, tenant-configurable permission roles enforced server-side on every request, plus a PII filter that walls custodians and contributors off from requestor and data-subject identity.
Hash-chained audit ledger
Every action across every module is written to an append-only, hash-chained ledger with integrity verification, exportable as court-ready evidence.
Hardened by default
TLS 1.3, Entra-only database authentication (no SQL credentials ever exist), storage that accepts Entra identities only (shared keys disabled), Microsoft Defender for SQL on by default, and FTPS and basic authentication disabled on the Azure backend from the first deployment.
Malware scanning and write-once evidence
Opt in to Microsoft Defender for Storage and every upload is scanned before anyone can preview, play, download, or release it. An optional write-once evidence container keeps exported packages and redaction masters immutable for your retention period.
Verified deploy artifacts
The deployment script verifies the published SHA-256 of every artifact and aborts on a mismatch — an integrity check on the supply chain, in your control.
Governed by your own security tools
Because AccessPoint runs in your tenant, Microsoft Defender for Cloud, Sentinel, and Purview monitor, audit, and govern it like any other workload — no separate security tooling to buy or bolt on.
Responsible AI, on your terms
AccessPoint's AI Assist is optional — it exists only if you choose to deploy it — and when you do, it runs by the same tenant-resident rules as everything else.
Deploying AI Assist adds an Azure OpenAI resource to your own Azure subscription and region. Data at rest never leaves your tenancy, you choose at deployment where inference is processed (globally, or bounded to the EU/US data zone), and Microsoft does not train its models on your content. Every AI output is a suggestion, an editable draft, or a read-only answer — a person always decides, and drafting marks anything it can't verify with a literal [VERIFY] rather than inventing it. Prompt and response content is never stored; only usage metadata is kept, and it feeds the case audit export's AI-involvement disclosure. A monthly token budget you control hard-stops all AI processing, and an Administrator acknowledges these terms once per tenant (recorded with user and date) — the same points many offices need for their own PIA or authority-to-operate. Running a government cloud doesn't rule AI Assist out either: Microsoft offers Azure OpenAI in Azure Government's US Gov Virginia and US Gov Arizona regions, approved within the FedRAMP High authorization for Azure Government and DISA's DoD Impact Level 4 and 5 provisional authorization. Model and feature availability differs between Government and commercial regions, so confirm the components you need for your region before you plan around them.
Recordings, transcripts, and detection stay in your tenant
Video and audio evidence is the most sensitive material an access office handles. AccessPoint never sends it to a third-party redaction service.
Body-worn camera footage, CCTV exports, 911 audio, and Teams meeting recordings are stored in your own storage account and reviewed in a viewer served from your own App Service. Face detection and region tracking run on the App Service itself, with a detector that ships inside the application — no cloud vision service is called, and no facial template or identity is computed or stored. Transcription uses an Azure AI Speech resource in your own subscription that reads the audio through its own managed identity; on-screen text detection uses your Azure AI Document Intelligence resource; and production-scale rendering runs in a scale-to-zero Container Apps job in your subscription whose container image is code only and can be mirrored into your own registry. Transcript text is gated like requestor PII, every machine-produced mark is a proposal until a person accepts it, and the released MP4 or MP3 ships with a manifest of file hashes and a per-span redaction log. Each of these services exists only if you choose to deploy it.
Aligned to the standards your program answers to
AccessPoint's architecture maps to the frameworks public-sector access and privacy offices are measured against. The full technical detail is in the architecture documentation and the government security controls guide.
ITSG-33
Security control mapping for Government of Canada IT systems.
GC Cloud Guardrails
Canadian data residency and cloud-security guardrails, deployed in your own tenant's subscription.
GDPR Article 30
Records of Processing (ROPA) built into the platform for EU obligations.
ISO 31000
The privacy risk register follows the ISO 31000 risk-management approach.
Backed by Microsoft
AccessPoint is published by a Microsoft Partner and reviewed and tested by Microsoft as part of the AppSource submission process before listing on the Microsoft commercial marketplace. You buy and pay for it through your existing Microsoft billing relationship — no new vendor to onboard, and often no separate procurement cycle.
What about SOC 2 or ISO 27001?
Those certifications attest to how a vendor protects data it holds in its own cloud. AccessPoint holds none of your data — it runs in your tenant, and we have no access. That assurance is one your own Microsoft 365 and Azure environment already gives you directly, so a vendor-hosting certification simply doesn't apply here.
For your security review
Printable documents your assessment can file — part of the procurement pack, with the deep technical detail in the public docs behind them.
Security & Architecture Overview
This page's story as a document your security reviewer can print, save as PDF, and attach to the file.
View & print →Vendor Questionnaire Answers
Hosting, residency, subprocessors, encryption, audit, AI, continuity, and exit — pre-answered for your assessment form.
View & print →Accessibility Statement
The WCAG 2.1 AA standard we design against, a self-assessed conformance report for the AccessPoint application, and how to reach us.
Read the statement →Security questions
Where is our data stored?
In your own Microsoft 365 and Azure tenant, in the region you choose. Case records, documents, recordings, transcripts and AI processing all stay inside your environment under the security controls, agreements and monitoring you already have with Microsoft. Realizer hosts none of it.
Does Realizer have access to our data?
No. AccessPoint's platform services — licence validation, Teams notifications, address discovery, jurisdiction packs and software distribution — never receive documents or case content. The privacy policy lists exactly what each service receives and why.
Is AccessPoint certified?
AccessPoint is published on the Microsoft commercial marketplace, where it is reviewed and tested by Microsoft as part of the AppSource submission process. Because it holds none of your data, vendor certifications such as SOC 2 attest to the wrong thing; the controls that matter are your tenant's, and Realizer publishes a security and architecture overview, vendor-questionnaire answers and a self-assessed accessibility conformance report for your review.
How is the optional AI governed?
AI Assist deploys into your own Azure subscription on Azure OpenAI with managed-identity access. Prompts and responses are never stored, Microsoft does not train models on your content, every output is a suggestion a person decides on, each feature switches individually, a monthly token budget you set caps spend, and each case's audit export discloses which AI features touched it.
What audit trail does AccessPoint keep?
Every change to a request, assessment, incident or complaint lands on a tamper-evident, hash-chained audit ledger, and a case audit export packages the record, its documents, redaction log, approvals and activity trail with a manifest of file hashes — the evidence a commissioner, an auditor or a court asks for.
Evaluate it in your own tenant
The surest security review is your own. Deploy AccessPoint into your environment and see exactly where everything runs.
Try It in Your Own Tenant — Free for 30 Days