Solutions · By capability

ATIP case management, rebuilt for the Microsoft 365 era

Access to Information Act and Privacy Act processing end to end — computed deadlines, records collected from your own tenant, redaction with exemption tagging, digital attestations, and statutory reporting — with your data never leaving your control.

Start Free Trial Request a Demo

ATIP case management software is having a forced generational turnover. AccessPro Case Management — the system much of the Government of Canada ran for two decades — was declared a legacy application effective June 2023, and every institution still on it needs a destination. That makes this the rare moment when an ATIP office gets to choose its next decade of tooling deliberately, rather than inheriting it.

The obvious move is replacing one request tracker with another. The better question is what the next system should carry: today's ATIP office doesn't just process requests — it runs Privacy Act obligations, privacy impact assessments, Algorithmic Impact Assessments under the Directive on Automated Decision-Making, breach responses, and complaint files from the commissioners. AccessPoint runs all of it on one platform with one hash-chained audit ledger, configured for federal ATIP by a jurisdiction pack.

And it does so inside your own Microsoft 365 and Azure tenant. The records under an access request are often the most sensitive a department holds; AccessPoint collects them straight from SharePoint, Outlook, and Teams and reviews them where they live, instead of copying them into a vendor's cloud.

What an ATIP office should demand from its next system

If you're replacing a legacy tracker, these are the capabilities that decide whether the next system lasts a decade — whichever vendor you choose.

Statutory clocks with consequences Due dates on business-day calendars with extensions and holds tracked against their legal basis — and deemed refusal recorded automatically when a date passes unanswered.
Both official languages, natively The interface ships in English and French (11 languages in total), and case content — scope, correspondence, closure summaries — can be translated per record with the original a click away.
Defensible search records Custodians certify their searches and production with digital attestations captured against the record — the evidence you want when completeness is challenged.
A PII firewall by construction Custodians and contributors work behind a filter that walls them off from requestor identity — enforced server-side, not by procedure.
Statutory reporting without a scramble The annual-report artifacts your oversight regime expects, generated from the same case data you process daily — plus dashboards for the questions the statute doesn't ask.
A migration path in, and out Your history should arrive with you — validated, with legacy case numbers preserved — and a business-readable export should always be one click away. Forced migrations taught that lesson.

How AccessPoint runs ATIP

The federal jurisdiction pack configures the statute; the platform operates the work.

Intake to acknowledgement in minutes

New-from-email turns an intake-mailbox message into a fully-formed request with the email attached as its first document; AI triage (optional) suggests a title, summary, scope, and clarification questions — nothing applies without a person.

Collection from the department's own M365

Search SharePoint, OneDrive, and Outlook and attach records directly — including Teams chats, OneNote pages, calendars, and Copilot interaction history — with collection tasks assigned to custodians and tracked to attestation.

Severance with statutory authority

A browser-native redaction studio where every mark carries its exemption — primary and fall-backs — with find-and-redact across documents, live patterns on new arrivals, and a defensible exemption manifest in the release package.

Consultations that keep their clocks

Inter-departmental and third-party consultations run with their own statutory windows, and templated bilingual correspondence flows through merge fields and the PII firewall.

An audit ledger built for challenges

Every action across every module lands in an append-only, hash-chained ledger with integrity verification, exported on demand as a court-ready case audit export.

The rest of the mandate, included

PIAs, Algorithmic Impact Assessments, breach response with a live notification calculator, complaints with statutory clocks, and an ISO 31000 privacy risk register — one platform, not five spreadsheets.

The AccessPro moment

Leaving a legacy system? Choose sovereignty this time.

The last generation of ATIP software made departments dependent on on-premises servers or vendor clouds — and its retirement forced migrations on everyone. AccessPoint's architecture is the counter-position: the platform, the data, and the exit all belong to you.

Runs in your own tenant Database, documents, and audit history in your Azure subscription; interface in your SharePoint and Teams; authentication through your Entra ID.
History comes with you A guided, validated Excel import brings historical requests, requestors, and documents in — legacy case numbers preserved, full audit provenance.
Never locked in again A business-readable export of everything, one click, any time. The exit being easy is exactly why staying is safe.

Go deeper

AccessPoint vs. AccessPro The legacy designation, what replaces it, and the migration path — sourced from government records. AccessPoint vs. ATIPXpress How the incumbent replacement path compares on scope, residency, and pricing. Canada federal ATIP jurisdiction pack The ATIA and Privacy Act configuration — deadlines, exemptions, fees, and reporting. Migrate your ATIP history The practical import path — validation, legacy numbering, document staging. Federal government solutions ATIP at departmental scale — the organizational view. Security & data sovereignty Exactly what deploys, where data lives, and who can see it.

ATIP Case Management Questions

What is ATIP case management software?
Software that operates Canadian access-to-information and privacy request processing end to end: intake and acknowledgement, statutory deadline computation under the Access to Information Act and Privacy Act, records collection and custodian tasking, review and severance with exemption tagging, consultations, fee handling, correspondence in both official languages, release packages, and the statistical reporting institutions must file. AccessPoint covers that full span — plus PIAs, AIAs, breach response, and complaints on the same platform.

We're migrating off AccessPro. Why consider AccessPoint over ATIPXpress?
ATIPXpress is a capable request tracker and the incumbent path for several institutions — if your deployment is already underway, finishing it may be right. If you're still choosing: AccessPoint runs the whole mandate (requests plus assessments, breaches, complaints, and risk) rather than requests alone, keeps every record inside your own Microsoft 365 and Azure tenant rather than a vendor cloud, and publishes flat annual pricing rather than quoting per seat. Our comparison pages lay both out with sources.

Does AccessPoint work in French?
Yes — the interface ships natively in both official languages (11 languages in total), and case content such as scope, correspondence, and closure summaries can be translated per record with the original always one click away. Letter templates from the jurisdiction pack are bilingual.

How does AccessPoint handle the Directive on Automated Decision-Making?
The same assessment engine that runs PIAs runs Algorithmic Impact Assessments — scored, tiered, reviewed, and published with an auditable trail — so the AIA obligation lands in the same governed system as the rest of your program rather than a standalone spreadsheet. There's a dedicated AI governance solutions page covering this in depth.

Can we bring years of ATIP history into AccessPoint?
Yes. The Data import & export panel generates an Excel template carrying your tenant's own type codes; historical requests keep their original numbers as legacy references, requestor contacts import alongside, and legacy documents stage through your own Azure storage with optional hash verification. Everything validates per row before anything imports, and imported records arrive historical — no notifications, no recomputed deadlines, full audit provenance.

The Next Decade of ATIP, In Your Own Tenant.

Try AccessPoint free for 30 days — the federal jurisdiction pack configures the ATIA and Privacy Act from day one.

Start Free Trial