An overview of the data Assuraz holds, why we hold it, and how it's kept secure.
This is a first draft, put together from what we already know about how Assuraz is built and hosted. It has not yet had a legal review, and should be checked and edited before being relied on as a final policy.
Last updated: 28 September 2026
Assuraz is a compliance management system used by businesses and consultancies to manage risk assessments, incidents, audits, training and other health, safety, environmental and quality records. This statement explains what personal data Assuraz collects, how it's used, and how it's kept secure, both for the people who log in to Assuraz and for the employees whose records a subscribing company holds within it.
Depending on how a company uses Assuraz, this can include:
Data is used to provide the Assuraz service itself — running the modules a company has subscribed to, sending the notifications and reminders a user has asked for, and giving each company visibility of its own compliance position. We also use it to maintain and secure the service, to communicate with account holders about their subscription, and to meet our own legal and accounting obligations.
Each company's data is kept separate within Assuraz and is only visible to that company's own users (and, where a company works with a consultancy through Assuraz, to that consultancy). It is not shared with other companies using the platform. Access within a company account is controlled by that company's own administrators, who decide which of their users can see and edit which records.
If a company turns on API Access, its administrators can create API keys that let the company's own systems (such as Power BI, Excel, an HR system or Active Directory) read from and send data to its Assuraz account. A key only ever reaches that company's data, can be limited to reading or to particular updates, and can be revoked at any time. Keys are stored only in a one-way hashed form, and each request is logged (the key used, the address, the time and the result) to keep the service secure and show the company its usage. The API never returns uploaded files, signatures, bank or tax details, or diversity information. Once a company has taken data into its own systems, it is responsible for that data there. See the API documentation.
Assuraz is hosted entirely on Microsoft Azure, in its UK data centres. Data is held in an Azure SQL database in the UK and encrypted both in transit and at rest. Notification and reminder emails are sent through Azure Communication Services. Payment for subscriptions is handled by our payment provider, Stripe — we do not store card details ourselves. Access to the underlying infrastructure is restricted to those who need it to operate and support the service.
Every Assuraz account login is protected by two-factor authentication — a second, one-time code, from either an authenticator app or email, entered alongside your password each time you sign in. Base Camp, the separate self-service portal for employees, offers the same two-factor authentication as an option each employee can turn on for their own login. Passwords are never stored in readable form, and a two-factor code is single-use and expires shortly after it's issued.
We retain data for as long as a company's account is active, and for a reasonable period afterwards to meet legal, accounting and audit-trail obligations that are typical of a compliance record-keeping system. A company can request deletion of its account data by contacting us, subject to any records we're required to keep by law.
When a company stops using Assuraz, we wind its data down in stages, counted from the date its service ends:
If you're based in the UK or EU, data protection law gives you rights over your personal data, including the right to ask what we hold about you, to have inaccurate data corrected, and to ask for it to be deleted where we're not required to keep it. If your data is held in Assuraz because your employer uses it, your employer is generally the right first point of contact, as they control what's entered into the system. You can also contact us directly using the details below.
Assuraz uses a small number of essential cookies needed to keep you signed in and to keep the application working correctly. We don't use cookies for advertising or cross-site tracking.
If you have questions about this statement or about the data Assuraz holds, please get in touch through your account administrator, or email privacy@assuraz.co.uk. If your data is held in Assuraz because your employer uses it, your employer is the data owner and should be your first point of contact.