Ready when the auditor asks
Compliance asks the same of documents whatever the regulation: an approved version, reviewed changes, access for those who need it, a log of what happened, and deletion when the rule says. M‑Files is set up to do all five, for GDPR, for ISO 9001 with VisualQMS and for your own policies.
What compliance asks of your documents
Compliance document management is keeping the documents a regulation or a standard requires under control: one approved version, changes that are reviewed and recorded, access limited to the people who need it, a log that shows what happened, and retention that keeps or deletes on time. M‑Files does this with metadata and workflows, so the rules follow a document into every view.
One approved version
Every change becomes a new version, the approved one is what people open, and the earlier ones stay behind it in the history.
Changes that are reviewed
A change goes through review and approval as a workflow, with tasks and deadlines, and moves on when all approvers have responded.
Access for those who need it
Permissions follow what a document is and who it concerns, so a document can inherit the rights of its project or its customer.
A log you can export
The event log records changes, downloads, deletions and each workflow step with the time and the user, and it can be filtered and exported.
Kept and deleted on time
Retention rules archive or delete documents after a set time counted from a date on the document, with a notice or a review first.
Reviewed before it falls due
A review date on a document creates a task before it passes, so a procedure is checked on time.
From draft to approved to retired
A controlled document is one whose changes are governed. In M‑Files the governing is a workflow, set up in a graphical designer rather than written as code, so the steps match your procedure.
-
Draft
The author
A new version is created and the approved one stays in force. The draft is open to the people working on it and to nobody else until it is approved.
-
Review and approval
Reviewers and approvers
Each gets a task with a deadline and a reminder before it. The event log records every state change with the time and the user, and an approval can carry an electronic signature.
-
Approved and published
Everyone with access
The approved version is what opens. A review date on the document creates a task before it passes, and M‑Files can run your own versioning scheme, such as revision letters.
-
Retired by rule
When a document is superseded or its time is up, a retention rule archives or deletes it after the period you set, with a notice or a review first. Deletion first hides the document; permanent destruction is a separate step.
What you can show an auditor
An audit is a set of questions about documents. These are the answers M‑Files has ready.
The version in force on a date
The version history shows which version applied on any date and what changed between versions.
Who approved it and when
Each approval is a workflow step recorded in the event log with the time and the user, and it can carry an electronic signature as well.
The log, filtered and exported
Changes, downloads and deletions for the period, exported as one file. With M‑Files' advanced logging module, the log also records each time a file is opened.
The requirement and what meets it
In VisualQMS, which runs on M‑Files, each requirement of a standard is linked to the documents, process diagrams and quality activities that meet it, so the auditor's question is answered from the requirement itself.
What the system keeps track of for you
- Data is deleted when its time is up — A deletion rule counts from a date, such as the day an employee left, and deletes the data when the period ends. Before that a notification can go out, or a list can show the deletions coming up.
- People see what their job needs — HR documents can be open to the employee, their manager and HR, and closed to everyone else. Access follows what a document is and who it concerns, and it can change as the work moves to a new step.
- A log of who changed what — Every change, download and upload is logged, and so are deletions. When an internal audit or a regulator asks, you filter the log and export it.
- One search finds everything about a person — Documents about a person are tagged with that person, so one search finds them all when someone asks what you hold about them. Documents export as they are or as PDF, other data as Excel.
Set up for the rules you answer to
We set M‑Files up for GDPR, and for quality management with VisualQMS. The controls are the same each time. What changes is which documents they cover, for how long, and who has access.
- GDPR — Personal data sorted by type, with deletion rules, access and subject access requests.
- ISO 9001 with VisualQMS — Controlled documents, training, audits and CAPA, with documents tagged to the requirements of the standard.
- Your own policies — Periods and access set for each type of document, to match the policies you work to.
M‑Files and GDPR
Ten data privacy requirements are put to a document or case management system under GDPR. See how M‑Files meets each one.
Read the requirementsGDPR and document management
A guide to handling personal data in a document management system.
Read the guideSecurity and compliance in M‑Files
Access control, encryption and the event log.
See the controls