Regulated businesses
In highly regulated businesses, the same controls are set up for your kinds of document and your retention periods.
M‑Files security
Access that follows the document
On a file share, access is a folder permission someone set years ago. In M‑Files it can follow what the document is, so an HR document gets the HR rule wherever it appears. Changes and downloads go into the event log, an audit trail you can filter and export, and deletion rules clear what has expired.
Day to day
What M‑Files keeps track of for you
- Who may see what — Access goes to a person or a group, and follows the kind of document and its customer, project or case. Rights can widen or narrow as a document moves through its approval.
- Who changed what: the audit trail — Changes to documents and their metadata, downloads, uploads, deletions and approval steps are recorded in an event log. You can filter and search it, and export what an auditor asks for.
- Deleted on time — Put a deletion rule on one document, a kind of document or a value in its metadata, and M‑Files carries it out. A notification or a list of upcoming deletions lets someone look first.
- The current version — People get the current version first, and every earlier version stays available.
- Encryption — In M‑Files Cloud, data is encrypted in storage and on its way over the internet. On your own servers, we set up encryption of the files, the database and the connection with you.
- A sign-in people already have — People sign in with the account they already have, through Microsoft Entra ID or your Windows domain, or with an M‑Files login.
Security
The facts an IT reviewer asks for first
These are M‑Files' own statements and certifications. They cover the platform; how your vault is set up is the implementation, and that is the part we do with you.
Encrypted in storage and transit
In M‑Files Cloud, your data is encrypted both in storage and on its way over the internet. On your own servers, we set up encryption of the files, the database and the connection with you.
Keys in your own Azure Key Vault
M‑Files Cloud can keep the file encryption keys in your own Azure Key Vault, the option to ask for when your policy requires customer-held keys.
Sign in through Microsoft Entra ID
M‑Files can sign users in through Microsoft Entra ID, so single sign-on, multi-factor authentication and offboarding follow your Microsoft set-up.
ISO/IEC 27001 certified
M‑Files holds an ISO/IEC 27001 certification that covers M‑Files Cloud, Hubshare and Aino.
Data processor with a DPA
M‑Files acts as a data processor under GDPR and offers a data processing agreement, the agreement your data protection lead will ask for.
Your documents do not train Aino
M‑Files states that your documents, metadata and questions are not used to train M‑Files Aino, and Aino only uses content the person asking is allowed to see.
Permissions follow metadata
Access rights can follow metadata, so a document inherits the permissions of the project or customer it belongs to, and a workflow state can widen or narrow them.
Controlled rendering and watermarking
Controlled rendering, printing and watermarking are there for the documents that should be read on screen and not passed around.
Audit trail
The event log as your audit trail
Auditors ask two things: who had access, and who did what. The event log answers the second, and this is what it holds.
- What the log records — Every change to a document or its metadata, every download and upload, every deletion and destruction, and every workflow state change, each with the time and the user. The log can be filtered and searched, and events can be exported, so what an auditor asks for can be handed over.
- Every time a file is opened — With M‑Files' advanced logging module, the log also records each time a file is opened, for the documents where reading itself must be on record.
- Signed approvals — A workflow state change is logged as standard. An electronic signature on a workflow step uses the same add-on module, for the approvals that must be signed as well as recorded.
Regulations
Set up for the rules you answer to
The controls are the same whether you answer to GDPR, ISO 9001 or a sector regulator. What we set up differently is who may see each kind of document and how long it is kept.
GDPR
Classification, access by role, logging, export and automatic deletion. Our GDPR page holds M‑Files up against the ten requirements put to a document system under GDPR, one by one.
M‑Files and GDPRISO 9001
Controlled documents with approval workflows and version control. VisualQMS adds process visualisation, training management, nonconformances, CAPA and audits.
VisualQMSQuestions IT and auditors ask
Where is our data stored?
M‑Files runs on-premises, on your own servers, in the cloud, or as a hybrid of the two. M‑Files Cloud is hosted in Microsoft Azure. Which one fits your requirements is part of scoping the implementation with us.
Can we see who changed or downloaded a document?
Yes. The event log records changes to documents and to their metadata, as well as downloads, uploads, deletions and workflow state changes. It can be filtered, searched and exported, and with M‑Files' advanced logging module it records each time a file is opened. For analysis over a long period, we can export every event to a separate reporting database.
Is there an audit trail in M‑Files?
Yes: the event log. It records every change to a document or its metadata, every download and upload, every deletion and each workflow state change, with the time and the user, and it can be filtered and exported. With M‑Files' advanced logging module it also records each time a file is opened.
Can access change as a document moves through a workflow?
Yes. A workflow step can give more people access or restrict it, so a document can stay with its author and reviewers until it is approved.
Is a deleted document gone for good?
Not at once. Deleting a document in M‑Files hides it from users, and destroying it permanently is a separate step. Deletion rules are set up as workflows that archive or delete after a set time, and a workflow can notify someone or ask for a review first.
Can external parties see documents?
Only what you share. M‑Files lets you share documents securely within and outside the company, and an extranet on M‑Files is one of the solutions we deliver. M‑Files Hubshare, licensed separately, gives invited clients and partners access only to the hubs they are invited to.
Is M‑Files certified?
M‑Files holds a third-party ISO/IEC 27001:2022 certification, and its scope covers M‑Files Cloud, M‑Files Hubshare and M‑Files Aino. It is M‑Files' own certification, not a certification of your organisation.
Which security features come with which edition?
Both editions encrypt data in M‑Files Cloud, set access by metadata and keep the event log. Enterprise adds an extended audit log with more events and exports, encryption keys in your own Azure Key Vault, federated sign-in through Microsoft Entra ID, and controlled rendering, printing and watermarking. Pricing and editions sets the two out, and we go through it with you.
Is M‑Files a data processor under GDPR?
Yes. M‑Files acts as a data processor under GDPR and offers a data processing agreement, and its ISO/IEC 27001 certification covers M‑Files Cloud as well as Hubshare and Aino. What your organisation does with the system, who may see personal data and when it is deleted, is your side of it. M‑Files and GDPR goes through it requirement by requirement.