Security

Hub and the product apps run on Cloudflare Workers. This public site is served by Cloudflare Pages.

Hub, Manage, Consult, Connect, and Migrate keep their records in PostgreSQL databases hosted by Supabase. Assess, Aware, Protect, Devices, Fleet, and Manage Licensing keep theirs in Cloudflare D1.

Accred Protect backups of Exchange Online mail and OneDrive files, and files uploaded as Assess evidence, are stored in Cloudflare R2.

Migrations run on the Migrate runner, a worker Accred operates. Files bound for SharePoint and OneDrive are staged briefly in Accred's Microsoft Azure storage before Microsoft imports them, and staged files are deleted within 7 days.

Connect devices check in through the Connect relay, which Accred operates on a DigitalOcean server behind Cloudflare's network.

Accred sends email, such as invitations, notices, and Aware lessons and practice emails, from its own Microsoft 365 tenant.

Payments are processed by Stripe. Accred does not store card numbers.

Accred sites and apps are served over HTTPS and send HTTP Strict Transport Security, so browsers never fall back to plain HTTP.

Stored data is encrypted at rest by the services that hold it: Supabase for databases, Cloudflare for D1 and R2, and Microsoft Azure for Migrate staging.

Credentials Accred keeps to reach other services, such as Microsoft 365 refresh tokens, AI provider keys you bring, and integration and webhook secrets, are encrypted again in the application with AES-256-GCM before they are saved.

Tokens that AI assistants use to connect, single-use sign-in handoffs, and device enrollment tokens are stored only as one-way hashes.

People sign in once, through Accred Hub, with Microsoft or with email. Microsoft sign-ins follow your organization’s own multifactor and Conditional Access policies.

Each app opens from Hub with a signed launch that works once and expires within five minutes. Apps check membership and role with Hub again while people work.

Hub assigns four roles: Owner, Admin, Member, and Viewer. Consult is assigned person by person, and Owners and Admins on a Consult + Connect seat are Connect technicians; Migrate, once turned on, opens for every member; Viewer cannot open Manage.

Organizations are kept apart. Row-level security is on for every table in the Supabase databases, and apps on Cloudflare D1 scope every query to the organization.

Hub and each app keep an audit log of changes: who changed what, and when. Manage Licensing’s log is hash-chained, so a changed or removed entry shows.

Nothing connects to a tenant until an administrator grants Microsoft consent. Each app asks for its own permissions, listed on the consent screen.

Assess discovery is read-only and never changes tenant settings.

Migrate scans, prechecks, and validation are read-only. Migration runs copy data into the destination tenant, and Migrate changes the source tenant only through the explicit Cutover steps an operator chooses to run.

Manage shows the tenant and the effect of an action before it runs, and logs every change. Single changes, such as removing a group member, run after a confirmation; onboarding, offboarding, and access-review removals need a second owner or administrator to approve.

Protect reads mail and files to back them up. Restore writes items back into the tenant and never replaces an item that is already there.

Devices reads Intune. Device actions are off until an administrator turns them on, and Devices never sends a wipe or retire.

Aware reads Attack Simulation Training results. It launches simulations or sends practice emails only after someone confirms the client agreed, only to people in the client’s directory, and only from a sender domain with SPF, DKIM, and DMARC in place.

For an attended session, the person at the computer chooses Allow or Deny. Deny is the default, and no answer in 60 seconds denies. Unattended access skips the prompt; a full install turns it on unless the organization turns it off.

Each computer has its own device key, which never leaves it. A technician’s session ticket works once, expires in two minutes, and opens only the computer it was issued for.

The Connect agent installs an update only after its signed manifest and file hash check out.

Session starts and ends are recorded. Actions taken with AI assistance are kept in an append-only log, and risky ones wait for a technician to approve.

The Hub assistant sends your question and the app data needed to answer it to the model provider your organization picks: Anthropic through Accred, OpenRouter, or your own key for Anthropic, OpenAI, Google, or OpenRouter. Conversations are deleted 90 days after their last message.

Keys you bring are encrypted with AES-256-GCM and never sent back to a browser. An owner can turn AI assistants off for the organization.

An assistant changes something only after a person presses Run on a confirmation that Accred builds on the server.

Assess asks OpenRouter to route its requests only to providers that do not keep the data. Assess scores are never computed by AI.

Accred has self-assessed its controls against the SOC 2 Trust Services Criteria, ISO/IEC 27001:2022 Annex A, NIST CSF 2.0, and CIS Controls v8 Implementation Group 1. Ask us for the self-assessments.

The Data Processing Addendum covers GDPR, UK GDPR, and CCPA, with Standard Contractual Clauses. Every company that processes personal data for Accred is on the Subprocessors page.

Read the security whitepaper (PDF), or check system status.

This site has no advertising tags or cookies of its own. It uses Cloudflare Web Analytics, which counts page views without cookies. A strict Content Security Policy allows only scripts and styles served by this site, plus the Cloudflare Web Analytics script and the Cloudflare Turnstile check.

The optional setup assistant answers through a server-side endpoint on this site, so the AI provider's key never reaches your browser. Accred does not log or store what you type; questions are rate-limited per network address and conversation, and the address is kept only as a keyed hash. Details are in the Privacy Policy.

Email hello@accredconsulting.com with "Security" in the subject line. Please include steps to reproduce, and do not access other customers' data. Accred will acknowledge your report and keep you informed. The same contact is published in security.txt.