Security

Last updated November 2, 2026

Accred does not claim SOC 2, ISO 27001, or any other security certification.

Where Accred runs

• Hub and the product apps run on Cloudflare's global network. This public site is served by Cloudflare Pages.
• Accounts, organizations, and app records are stored in PostgreSQL databases hosted by Supabase.
• Accred Protect stores backups of Exchange Online mail and OneDrive files on Cloudflare, encrypted at rest.
• Migrations run on the Migrate runner, a worker Accred operates. Files bound for SharePoint and OneDrive are staged briefly in Accred's Microsoft Azure storage before Microsoft imports them.
• Connect devices check in through the Connect relay, which Accred operates on a DigitalOcean server behind Cloudflare's network. Remote sessions are coming soon.
• Payments, such as the expanded Assess assessment, are processed by Stripe. Accred does not store card numbers.

Encryption

• Accred sites are served over HTTPS. This site also sends HTTP Strict Transport Security, so browsers never fall back to plain HTTP.
• Supabase encrypts stored data at rest.

Access control

• People sign in once, through Accred Hub. Hub checks organization membership and role before any app opens.
• Hub assigns four roles: Owner, Admin, Member, and Viewer. Consult is assigned person by person; Connect and Migrate, once turned on, open for every member; Viewer cannot open Manage.
• Database access rules scope records to the organization that owns them.
• Hub keeps an audit log of administrative changes: who changed what, and when.

Your Microsoft 365 tenant

• Nothing connects to a tenant until an administrator grants Microsoft consent.
• Assess discovery is read-only and never changes tenant settings.
• Migrate scans, prechecks, and validation are read-only. Migration runs copy data into the destination tenant, and Migrate changes the source tenant only through the explicit Cutover steps an operator chooses to run.
• Manage shows the tenant and the effect of an action before it runs, and logs every change. Single changes, such as removing a group member, run after a confirmation; onboarding, offboarding, and access-review removals need a second owner or administrator to approve.

This public site

This site has no advertising tags or cookies of its own. It uses Cloudflare Web Analytics, which counts page views without cookies. A strict Content Security Policy allows only scripts and styles served by this site, plus the Cloudflare Web Analytics script and the Cloudflare Turnstile check.

The optional setup assistant answers through a server-side endpoint on this site, so the AI provider's key never reaches your browser. Accred does not log or store what you type; questions are rate-limited per network address and conversation, and the address is kept only as a keyed hash. Details are in the Privacy Policy.

Report a security issue

Email hello@accredconsulting.com with "Security" in the subject line. Please include steps to reproduce, and do not access other customers' data. Accred will acknowledge your report and keep you informed.