Security at Apexward Assure
You would be putting your control evidence, your risk register and your supplier assessments into our platform. It is reasonable to ask how that platform is secured.
Written by Apexward Assure editorial team
Reviewed by Apexward Assure product team
Last reviewed: 30 August 2026
Where it runs
The shared platform runs on UK and EU infrastructure. Each organisation gets its own tenant with row-level isolation, so one customer’s data is not reachable from another’s session even in the event of an application-layer bug. Enterprise customers get a dedicated, self-hosted instance in a region they specify, which is usually why they move.
Data in transit and at rest
Everything is served over TLS, with HSTS and a strict content security policy. Data at rest is encrypted, and evidence files are checksummed on upload so that a file’s integrity can be demonstrated later rather than assumed.
How people sign in
Authentication is passwordless by default: passkeys, or a signed email link. There is no password to phish, reuse or leak. Organisations that run their own identity provider can connect it instead and keep sign-in under their existing conditional-access policy.
Access inside a tenant is role-based. Auditors get a role that can read evidence and raise questions but cannot change the programme they are assessing, which matters more than it sounds - an assessor should never be able to alter the thing they are certifying.
What is logged
Every consequential action writes to an immutable audit log: who did it, when, and what changed. That log is visible to you in the platform, because it is as much your evidence as it is our record.
How suppliers and staff take part
Supplier questionnaires, training and the Trust Centre work through scoped, expiring links rather than accounts. A supplier answering your questionnaire never gets a login to your tenant, and the link they were sent grants nothing beyond the assessment it was issued for.
Our own posture
We run Apexward Assure on Apexward Assure. Our own control programme, monitoring and evidence live in the product, which is both a useful discipline and the fastest way for us to notice when something in it does not work.
If you have a security question this page does not answer, or you need to complete a supplier assessment on us, email hello@apexward.com and a person will answer it.