Security & compliance
Built on Microsoft’s cloud. Protected by Microsoft Entra ID.
M365 Vault doesn’t run its own file servers. Borrower documents go straight into Microsoft’s cloud and stay there, protected by the same encryption and identity controls Microsoft provides to banks and government agencies.
The path a document takes
Three stops, encrypted the whole way.
1 · The borrower’s device
Encrypted before it leaves
The upload page only works over HTTPS. Files travel encrypted with TLS from the borrower’s browser to Microsoft’s cloud. Large files are sent in pieces and retried automatically.
HTTPS / TLS 1.2+2 · Microsoft’s data centers
Encrypted at rest
Files are stored in Microsoft’s cloud, where Microsoft encrypts data at rest with BitLocker disk encryption plus per-file encryption, each with its own AES-256 key.
AES-256 at rest3 · You
Opened only after you sign in
Your folder opens only after you sign in through Microsoft (Microsoft Entra ID), which supports multi-factor authentication. Borrowers can send files but can never browse or download them.
Microsoft Entra ID sign-inControls
How documents are protected
Least-privilege upload service
The upload service has Microsoft Graph permission to one SharePoint site only: the M365 Vault site. It can’t reach email, other sites or anything else in the tenant. Its credentials live in Azure, never in the browser.
No browsing, no downloads for senders
The upload page can only add files to a folder. It can’t list, open or download anyone’s documents, so a borrower (or anyone who finds a link) can never see what others sent.
Malware protection
Microsoft 365’s built-in malware protection checks uploaded files, and a file that hasn’t been checked yet is scanned before it can be downloaded in a browser.
One folder per loan officer
Each SecureSend link is tied to one loan officer’s folder. The page shows that name before anything is sent, and unknown links are refused.
Why not just email?
M365 Vault vs. the usual options
| What matters | M365 Vault | Regular email | Fax |
|---|---|---|---|
| Encrypted in transit | Yes | Sometimes | No |
| Encrypted at rest | Yes | Depends on provider | No |
| Borrower needs no account | Yes | Yes | Yes |
| Files stay out of inboxes | Yes | No | Paper copies |
| Large files and phone photos | Up to 500 MB each | Attachment limits | No |
Compliance
Supports your GLBA Safeguards program.
Under the Gramm-Leach-Bliley Act Safeguards Rule, your company must protect customer information with safeguards such as encryption in transit and at rest and controlled access. M365 Vault gives you a practical way to meet those expectations for documents borrowers send you.
Compliance is still your company’s program. M365 Vault is one tool in it, so confirm with your compliance officer how it fits your policies.
M365 Vault is for getting documents to you safely. Download files into your loan origination system and remove them from your folder once you have them. The less sensitive data sits anywhere, the lower your risk.
Questions
Security questions from loan officers
Where are the documents actually stored?
In Microsoft’s cloud, in a SharePoint site that belongs to the M365 Vault Microsoft 365 tenant. Each loan officer has a private folder there. M365 Vault doesn’t keep copies anywhere else.
Who can see the files a borrower sends me?
You, after signing in with your Microsoft account. The upload page can add files but can’t read them, and borrowers can never see or download anything. Like any Microsoft 365 service, the M365 Vault administrators can manage folders when needed, for example to set up your account or remove old files.
Is it GLBA compliant?
No product is “GLBA compliant” on its own; compliance is your company’s program. M365 Vault provides encryption in transit and at rest and signed-in access, which support the Safeguards Rule. Ask your compliance officer how it fits your written information security program.
Is it HIPAA compliant?
M365 Vault is designed for mortgage documents and isn’t offered as a HIPAA service. Don’t use it for protected health information unless your compliance officer approves.
How long do documents stay in my folder?
Until they’re removed. M365 Vault is a delivery tool, not long-term storage, so please download files into your loan system and delete them from your folder.
Do you track visitors to this site?
No. This site uses no advertising or analytics cookies. See the privacy policy.
Put a secure link in your signature today.
Set up takes a few minutes. Your borrowers get the easiest way to send documents safely, and you look like the professional you are.