How Assuraz protects the records you and your employees keep in it: where it is hosted, how it is encrypted, how sign-in works and how each company's data is kept apart.
UK hosted
Application, database and files in Microsoft Azure UK data centres
Encrypted
HTTPS everywhere, with encryption at rest for the database and files
Two-factor
Multi-factor authentication on every account sign-in
Scanned
Every uploaded file checked for malware
Isolated
Each company’s data separated and checked on every request
Backed up
Automated database backups with point-in-time restore
This statement describes how Assuraz is built and hosted today. It is still being reviewed and should be checked before being relied on as a final statement.
Last updated: 23 October 2026
Assuraz runs entirely on Microsoft Azure, and both the application and your data are hosted in Azure's UK data centres. Your records, uploaded files and backups are held in the UK. Azure's data centres are independently certified against ISO/IEC 27001 and other recognised standards, and physical security of the buildings and hardware is managed by Microsoft.
Everything between your browser and Assuraz travels over HTTPS, and browsers are told to use nothing else. Data is also encrypted between the application and its database, and again where it is stored.
Every Assuraz account sign-in needs a password and a second, one-time code. A correct password on its own never signs anyone in. Base Camp, the employee portal, offers the same two-factor authentication for each employee to turn on.
Each company's data is visible only to its own users, and to a consultancy where the company works with one through Assuraz. Every request to the server is checked against who is signed in and which company they are working in before any data is read or changed, so a user cannot reach another company's records by design, not just by convention.
Assuraz sends modern browser security headers on every page, limiting what a page can load and how it can be embedded, to protect against cross-site scripting, clickjacking and content sniffing.
Documents, certificates, safety data sheets, photos and other uploads are stored in Azure Blob Storage, which has Microsoft Defender for Storage malware scanning turned on, so every uploaded file is scanned. Files are served through Assuraz itself, after the same sign-in and company checks as everything else, rather than from public links.
The database is backed up automatically and continuously by Azure, with the ability to restore it to a point in time. Backups stay in Azure and are managed as part of the hosting, so no company needs to set them up or remember to run them. When a company stops using Assuraz, its data is handled under our published retention stages; see the Privacy Statement.
We use a small number of providers, each only for the job described.
If you believe you have found a security issue or vulnerability in Assuraz, please tell us through your account administrator or the contact form, giving as much detail as you can. We will look into every report and keep you informed.