Secure document upload for mortgage brokers

A single mortgage file typically contains a passport image, a driving licence, several months of bank statements, payslips, a credit report and sometimes medical information gathered for protection. If a criminal designed a target for identity fraud, it would look very much like a broker's document store.

That is the reason secure upload matters. It is not a compliance box. It is that the material you routinely handle is unusually valuable to the wrong people.

What "secure" means in practice

Vendors use the word loosely, so break it into parts you can ask about.

Encryption in transit, meaning the connection between the client's phone and the server. This is universal now and not a differentiator.

Encryption at rest, meaning the stored files are encrypted on disk. Ask whether it is enabled by default and who holds the keys.

Access control, meaning which of your staff can open which client's files. In small firms everyone can see everything by default, and that is a decision worth making deliberately rather than inheriting.

Supplier access, meaning whether the vendor's own staff can view client documents and under what circumstances. Ask directly. The answer is usually that support staff can with permission, which is reasonable, but you should know it.

Location, meaning where the data physically sits and which sub-processors are involved.

Authentication, meaning how the client proves they are the client. A link emailed to an address with no further check is convenient and weak. A link plus a code sent to a known mobile number is meaningfully better.

The link that is not really a link

The most common insecure pattern is not the upload itself. It is the email that carries the invitation.

If your invitation is a bare URL that anyone possessing it can use, the security of the whole arrangement is the security of the client's mailbox, which you know nothing about. Time-limited links, single-use links and a second factor all reduce that exposure.

Equally, watch what your own staff do with completed documents. Downloading a passport scan to a desktop to attach to a lender email undoes everything the upload achieved. Where a lender requires email submission, at least use whatever encryption or portal the lender offers, and delete the local copy afterwards.

Your obligations, briefly and without drama

A brokerage handling client documents is a data controller. Under UK data protection law that brings a set of duties, and the ones that bear on document storage are these.

You must hold the data for a defined purpose and no longer than necessary. "Forever, in case" is not a retention policy. Set periods, write down the reasoning, including the periods driven by regulatory record-keeping expectations, and apply them.

You must be able to tell a client what you hold about them and provide it. A subject access request against a firm whose documents are scattered across a portal, a shared drive and three mailboxes is a very unpleasant week.

You must protect the data with appropriate measures, proportionate to its sensitivity. Identity documents and financial records sit at the sensitive end.

And you must report a personal data breach to the Information Commissioner's Office within 72 hours where it is likely to result in a risk to individuals. Knowing this in advance matters, because the clock starts when you become aware, not when you finish investigating.

The breach that actually happens

Firms imagine sophisticated attacks. What usually happens is duller.

Documents sent to the wrong client, because two people have similar surnames and autocomplete did the rest. A departed employee whose access was never revoked. A laptop taken from a car. A shared folder link set to "anyone with the link" three years ago and forgotten. An administrator forwarding a file to a personal email account to work on at home.

Every one of those is a process problem, not a technology one, and none is prevented by buying a better upload tool.

A short internal checklist

Name one person responsible for access reviews, and have them check quarterly who can see client documents.

Revoke access the day someone leaves, including any shared logins, which should not exist but do.

Turn on two-factor authentication on every system holding client data, without exceptions for senior people.

Encrypt laptops and phones that can reach client files.

Ban personal email and personal cloud accounts for client material, and then make sure the sanctioned route is easy enough that nobody needs to break the rule.

Know, today, who you would call if you discovered a breach on a Friday afternoon.

What to ask a supplier

Where is data hosted and who are your sub-processors? Is data encrypted at rest and who manages the keys? Can your staff view our clients' documents, and is that logged? What authentication options exist for client links? Can we set retention rules and does deletion actually delete? Do you hold a recognised security certification, and can we see the current scope? What is your breach notification commitment to us as controller?

Ask for the data processing agreement and read it. That document, rather than the sales page, is what you are relying on.

Confirm all of this directly with the supplier and treat any general article, including this one, as a prompt for questions rather than a source of answers.

The proportionate view

Do not let this become paralysing. The realistic goal is a firm where client documents travel by one known route, sit in one known place, are visible to a known list of people, and are deleted on a schedule. Most brokerages are one afternoon of decisions away from that, and the afternoon is worth taking.