Secure File Sharing for Mortgage Brokers

Secure file sharing lets a brokerage collect client documents through controlled links or a portal, with permissions that can be reviewed and withdrawn. Client portals, CRM collection tools and business cloud storage organise that work differently. The useful comparison is who can upload, who can read and who controls the loan-file record.

A bank statement upload needs more than an encrypted connection. The client must reach the right destination, and one applicant must never see another applicant’s documents.

Why Email Attachments Are Risky

Email attachments create copies of client information in places the brokerage cannot fully control. A payslip can remain in the client’s Sent folder, the broker’s inbox and downloaded files long after the application finishes.

Three separate failure paths matter. A mistyped or auto-completed address can send the attachment to the wrong person. A compromised mailbox can expose documents already stored there. An unprotected transmission can expose the content in transit. Transport encryption reduces interception risk but does not correct the recipient address or secure a compromised inbox.

The Office of the Australian Information Commissioner discusses email controls in its guide to securing personal information. A file-sharing link can reduce attachment copies, although a public link that anyone can open creates its own exposure.

Preserve the original bank statement when authenticity or a disputed transaction becomes an issue. If a dispute becomes a legal investigation, FinTrace provides forensic bank statement analysis for legal teams and investigators. Secure delivery and examination of a statement’s contents are separate tasks.

For situations that still call for email, assess the secure email controls separately. Changing the delivery channel does not remove the need to verify the recipient.

Secure File Sharing Options for a Brokerage

The options differ in document collection, account ownership and the controls available to administrators.

Option	Collection and access	Brokerage fit	Subscription structure
Client portal	Can give each client a login and keep a checklist beside their uploaded documents. Encryption and audit evidence depend on the provider.	A dedicated client-facing collection process, with its own administration and connection to the loan file.	Standalone subscription, usage-based service or part of another product.
CRM document collection	Can attach requested documents to an applicant or deal record. Review staff permissions and the client’s view separately.	Collection within the brokerage’s existing deal workflow. Confirm what happens when staff leave or a file is exported.	Included in the CRM or sold as an additional feature.
Microsoft 365 and SharePoint	Named-recipient sharing, organisation-level external-sharing settings and upload-only file requests where enabled.	Team document libraries and access administered through the business’s Microsoft environment.	Business Basic, Business Standard and Business Premium use per-user subscriptions.
Dropbox	File requests collect uploads without giving the sender folder access. Paid plans add link passwords and expiry controls.	A separate file-sharing workspace, with team administration on business plans.	Standard and Advanced team subscriptions, with an Enterprise offering.
Google Drive	Named-recipient permissions, shared drives and administrator sharing policies in Google Workspace.	Collaborative document storage within the brokerage’s Google Workspace environment.	Business Starter, Business Standard and Business Plus use per-user subscriptions.
Box	Shared-link permissions and File Request forms. Building a File Request form requires Business or higher.	A content workspace with collection forms and business administration.	Business and Business Plus subscriptions, with Enterprise tiers and other plans.
iCloud Drive	Invited-person sharing and view or edit permissions. Shared encryption depends on the sharing mode and participants’ settings.	Apple-account collaboration where the brokerage has defined ownership, recovery and record-keeping arrangements.	Free storage allocation with paid iCloud+ storage plans.

For a portal or CRM, request the provider’s security documentation before approving client uploads. It must explain encryption in transit and at rest, staff access and what happens to stored documents when the service ends. A portal label does not prove those controls exist.

Box uses TLS in transit and AES-256 encryption at rest. It documents its File Request requirements. Uploaders do not need a Box account, and the form can collect files without making them collaborators on the destination folder.

iCloud Drive encrypts files in transit and at rest. Advanced Data Protection can preserve end-to-end encryption for shared content when all participants have it enabled. Apple’s sharing guidance explains that sharing with anyone who has the link does not support that protection. Keep the distinction between storage encryption and the permissions on the shared item.

Is Dropbox, OneDrive or Google Drive Safe?

Dropbox, OneDrive and Google Drive can support client-document sharing when the brokerage uses appropriate accounts and restricts access. Their standard encryption protects data travelling to the service and stored there. It does not stop an authorised recipient from downloading a copy or fix an overly broad sharing permission.

Dropbox Security

Dropbox describes TLS protection in transit and AES-256 encryption at rest in its security architecture. Standard and Advanced are team plans, while Enterprise provides a separately arranged offering. Those plans give a business a different administration model from a staff member’s personal account.

Paid shared-link controls include passwords and expiration. These controls apply to that link. A person added directly to the file or folder keeps their separate permission, so expiring a link does not remove every access path.

Dropbox fits a client-document process when the team account owns the records and the collection folder exposes only the intended content. Its file-request feature is distinct from sharing a folder for clients to browse.

OneDrive and SharePoint Security

Microsoft documents TLS for internet connections and AES-256 per-file encryption in its OneDrive and SharePoint encryption guidance. SharePoint provides team libraries, while OneDrive is tied to an individual user’s storage within the organisation.

For outbound documents, Specific people links restrict access to the people you name. Anyone links are transferable, and access through them cannot identify an authenticated recipient. Microsoft explains these differences in its sharing-link documentation.

For collection, Microsoft’s file requests let someone upload without seeing the folder’s contents. The feature requires administrator approval and Anyone links to be enabled. A business that prohibits anonymous links must resolve that policy conflict before enabling file requests.

Google Drive Security

Google Drive encrypts files in transit and at rest. Its encryption documentation distinguishes that standard protection from optional Workspace client-side encryption. Client-side encryption needs an eligible account and administrator configuration.

Google Workspace adds business account administration and shared drives. Its Business Starter, Business Standard and Business Plus editions differ in storage and administrative capabilities. A business subscription’s name alone does not establish that every advanced security control is included.

In Drive, the permission on a parent folder can expose the files inside it. Google’s sharing instructions explain the inherited access. Use a separate client folder with the intended participants, and keep General access set to Restricted for named-recipient sharing.

Each service can fit the job when its permissions, ownership and retention arrangements match the brokerage’s requirements. Free secure file sharing plans require the same assessment. Free storage does not establish that the account includes the business controls or activity records you need.

Set Up Sharing With Clients

Set up a separate collection location for each application, then prove its permissions using harmless files before collecting real documents. An administrator must configure organisation-wide controls where the service requires them.

1. Create the application folder or portal request under a business-controlled account. Use an internal file reference where possible, without putting identity numbers in a link or folder title.
2. Add only the staff handling that application. Review inherited access from parent folders and groups before inviting the client.
3. Choose the client’s permission for the task. An upload-only request collects documents without granting folder browsing. An invitation to view documents is a different permission.
4. Set an expiry for temporary access where supported. For example, a request might remain open for seven days, then be renewed if the client needs more time.
5. If the approved sharing mode uses a link password, set it and deliver it through a separate verified channel. A password-protected public link can still be forwarded with its password.
6. Test the link with a dummy document from the client’s perspective. Confirm the client can complete the intended action and cannot see another application. Revoke the test link and confirm it stops working.

Where to Find Link Controls

Service	Recipient controls	Expiry and password controls	Collection distinction
OneDrive or SharePoint	Open Share, then Link settings. Select Specific people and set view or edit access as required.	Settings depend on link type and subscription. Passwords and folder-link expiry apply to Anyone sharing. Guest-access expiry is a separate administrator policy.	Request files is upload-only, but requires Anyone links to be enabled.
Dropbox	Open Share and its settings, then choose the viewing or editing link you are configuring.	On eligible plans, turn on Require password or Expiration, enter the value and save.	Create a File request for incoming documents. Close the request when collection ends.
Google Drive	Open Share, add the recipient and set the permission. Keep General access Restricted.	Eligible work or school accounts can use Add expiration beside a person’s permission. Use recipient authentication for access control.	An editable shared folder exposes its contents to editors. It is a different arrangement from an upload-only request.
Box	Open Share and select the permitted audience, such as Invited people only.	In Link Settings, use Link Expiration where enabled. Require Password applies to People with the link sharing.	File Request collects uploads without adding folder collaborators.

Microsoft’s OneDrive sharing guide explains its link-type restrictions. Box’s sharing controls explains which controls depend on account and administrator settings.

A link password protects access to the hosted item. If you need to password protect a PDF itself, that is a separate control on the downloaded file.

Limit External Sharing and Inspect Logs

In the SharePoint admin centre, open Policies > Sharing. Set the organisation’s permitted external-sharing level, then apply narrower site settings where needed. Microsoft’s external-sharing controls also cover domain restrictions and guest-access expiry. Blocking consumer email domains can prevent clients using personal email addresses from joining.

In Google Workspace, an administrator manages Drive sharing under Apps > Google Workspace > Drive and Docs > Sharing settings. Apply the policy to the relevant organisation or group. The client’s permission on the actual file must still be checked.

For Microsoft 365 audit evidence, an authorised administrator opens Microsoft Purview, selects Audit and searches Sharing and access request activities. Dropbox team administrators use Admin console > Activity. Google administrators use Reporting > Audit and investigation > Drive log events.

Log detail and retention depend on the subscription and event. Dropbox limits some file-level activity to higher team plans. Google states that not all Drive activity is logged. Review a dummy sharing event and a revocation event before depending on those records to investigate a client-file incident.

Collecting Documents for a Loan File

A document collection process starts with a specific request and ends with a controlled loan-file record. Assign one staff member to track what arrived so clients are not asked to resend the same identity document through several channels.

1. Request only the documents needed for the application stage. State the required statement period and explain where the client must upload each file.
2. Verify the client’s contact details before sending the invitation. Tell them how to confirm an unexpected document request through the brokerage’s established contact number.
3. Match incoming files to the application. Check that every page is present and readable, then record missing items in the document checklist.
4. Preserve original bank statements and identity documents in the approved loan-file location. Limit staff access and keep the record under the licensee’s retention schedule.
5. Close the upload request when collection finishes. Remove temporary client permissions and check for separately shared links or direct invitations that remain active.
6. Remove duplicate downloads and staging copies when the retention policy permits. Include mailbox attachments and local synchronisation folders in that review. A link expiring does not delete the underlying file or copies someone already downloaded.

If a client uploads into the wrong application, restrict access to that location immediately and follow the brokerage’s incident procedure. For a missing upload, inspect the destination folder and storage allowance before asking the client to send it again. Keep the next request in the same controlled collection process.