AccessPoint — Security & Architecture Overview
Prepared for security reviewers and IT approvers. The full technical detail behind every statement here is public in the architecture documentation.
Vendor: Realizer Services Inc. · Product: AccessPoint · Last reviewed: August 2026
The deployment model, in one paragraph
AccessPoint installs entirely inside your organization's own Microsoft 365 and Azure tenant. Every request, document, assessment, incident, and audit record lives in your environment and never leaves it. Realizer Services operates no hosting environment for customer data and has no runtime access to your deployment — there is no vendor cloud to breach, no subprocessor chain to assess, and no cross-border transfer to manage. The environment AccessPoint runs in is one your organization already owns, has already secured, and already monitors.
What deploys
| Component | What it is | Where it runs |
|---|---|---|
| SharePoint app | The interface your access and privacy team works in daily. | Your SharePoint Online (Microsoft 365 tenant), installed from Microsoft AppSource. |
| Azure backend | The API, database, and storage that run the platform, provisioned in one pass from a Bicep template. | Your Azure subscription, in the region you choose. |
| Microsoft Teams app (optional) | The same interface inside Teams, with activity-feed notifications. | Your Microsoft 365 tenant. |
| AI Assist (optional) | Drafting, redaction suggestions, triage, and case Q&A. Exists only if you choose to deploy it. | An Azure OpenAI resource in your own Azure subscription and region. |
Data residency & vendor access
- All customer data resides in your Microsoft 365 tenant and your Azure subscription, in the region you select at deployment.
- Realizer Services has no runtime access to your environment and holds no copy of your data.
- No subprocessors handle your data — there is no vendor-side processing of customer content.
- The product initiates no cross-border data transfers.
Identity & access control
- Authentication: Microsoft Entra ID only — no new passwords or app-specific accounts. Your existing MFA and Conditional Access policies apply in full.
- Authorization: granular, tenant-configurable permission roles enforced server-side on every request.
- PII firewall: a permission layer that walls records custodians and contributors off from requestor and data-subject identity.
Hardened by default
- TLS 1.3 for data in transit; data at rest is protected by Microsoft 365 and Azure platform encryption in your environment.
- Entra-only database authentication — no SQL credentials ever exist.
- Microsoft Defender for SQL enabled by default; FTPS and basic authentication disabled on the Azure backend from the first deployment.
- Supply-chain integrity: the deployment script verifies the published SHA-256 hash of every artifact and aborts on a mismatch.
Auditability
Every action across every module is written to an append-only, hash-chained audit ledger with integrity verification, exportable as court-ready evidence. Imported historical records carry explicit provenance entries.
Monitored by the tools you already run
Because AccessPoint runs in your tenant, Microsoft Defender for Cloud, Microsoft Sentinel, and Microsoft Purview monitor, audit, and govern it like any other workload in your environment — no separate security tooling to buy or bolt on.
Standards alignment
| Framework | How it applies |
|---|---|
| ITSG-33 | Security control mapping for Government of Canada IT systems — detailed in the government security controls guide. |
| GC Cloud Guardrails | Canadian data residency and cloud-security guardrails, deployed in your own tenant's subscription. |
| GDPR Article 30 | Records of Processing (ROPA) built into the platform for EU obligations. |
| ISO 31000 | The privacy risk register follows the ISO 31000 risk-management approach. |
A note on SOC 2 and ISO 27001
Those certifications attest to how a vendor protects data it holds in its own cloud. AccessPoint holds none of your data — it runs in your tenant, and we have no access. That assurance is one your own Microsoft 365 and Azure environment already gives you directly, so a vendor-hosting certification does not apply to this deployment model. Application-level security questions are welcome: ask us directly.
Optional AI, on your terms
AI Assist exists only if you deploy it. When you do: inference runs against an Azure OpenAI resource in your own subscription; Microsoft does not train models on your content; prompt and response content is never stored (only usage metadata, which feeds the case audit export's AI-involvement disclosure); every output is a suggestion a person decides on; a monthly token budget you control hard-stops all AI processing; and an administrator acknowledges these terms once per tenant, recorded with user and date.
Questions
Bring your security and IT reviewers to a walkthrough — book a demo and we'll go as deep on architecture as your team wants. Written questions: contact us and we'll respond within one business day.