Security
Last updated October 21, 2026
How the Accred suite is hosted, how access works, and what the apps can and cannot do in your Microsoft 365 tenant. Accred does not claim SOC 2, ISO 27001, or any other security certification.
Where Accred runs
- Hub and the product apps run on Cloudflare's global network. This public site is served by Cloudflare Pages.
- Accounts, organizations, and app records are stored in PostgreSQL databases hosted by Supabase.
- Payments, such as the expanded Assess assessment, are processed by Stripe. Accred does not store card numbers.
Encryption
- Accred sites are served over HTTPS. This site also sends HTTP Strict Transport Security, so browsers never fall back to plain HTTP.
- Supabase encrypts stored data at rest.
Access control
- People sign in once, through Accred Hub. Hub checks organization membership and role before any app opens.
- Roles are Owner, Admin, Manager, Member, and Viewer. Consult and Migrate are assigned person by person; Connect, once turned on, opens for every member; Viewer cannot open Manage.
- Database access rules scope records to the organization that owns them.
- Hub keeps an audit log of administrative changes: who changed what, and when.
Your Microsoft 365 tenant
- Nothing connects to a tenant until an administrator grants Microsoft consent.
- Assess discovery is read-only and never changes tenant settings.
- Migrate scans, prechecks, and validation are read-only and never write to the destination tenant.
- Manage shows the tenant and the effect of an action before it runs. Changes that remove or delete anything stay off for now.
This public site
This site has no forms, analytics, or advertising tags. A strict Content Security Policy allows only scripts and styles served by this site.
Report a security issue
Email hello@accredconsulting.com with "Security" in the subject line. Please include steps to reproduce, and do not access other customers' data. Accred will acknowledge your report and keep you informed.