Important. If the application package can be downloaded from email or your system of record, safeguards are needed to reduce transfer through personal email, cloud storage, or USB.

If downloadable from email

For applications that arrive by email and are opened by a person.Choose at least one:

  1. Change to automated intake. Route submissions straight into your system of record, so no one handles files in email.
  2. Watermark before the inbox. Aquamark email watermarking or an equivalent provider.
  3. Browser and device controls. Block personal email, cloud storage sites, and USB.

If downloadable from system of record

For your CRM or other system of record.Choose at least one:

  1. Change to view-only access. Staff can open application files but can’t download them.
  2. Watermark. Before files are stored, or at download, using Aquamark or an equivalent service.
  3. Browser and device controls. Block personal email, cloud storage sites, and USB.

Setup guidance

Watermarking

No browser or device controls needed. Watermarking is accepted as a reasonable deterrent against theft. Watermarks should include your company name or logo. Aquamark or an equivalent service can be used, and watermarked files can stay downloadable.

If you accept email submissions and people open them: watermark files before they reach the inbox. This also covers your system of record, since stored files are already watermarked.

If files go straight to your system of record (online applications, or email routed automatically): watermark files before they’re stored, or at the time of download.


Browser and device controls

No watermarking needed. Files can stay downloadable from email and your system of record if these controls block personal email, cloud storage sites, and USB.

Safeguards must restrict personnel from moving data outside the company. At a minimum:

  • Domain restrictions: Block access to personal email, personal cloud storage, and unauthorized file-transfer services.
  • USB restrictions: Block or restrict copying company files to physical media.

Tools that can help

  • Endpoint/MDM policies: Microsoft Intune, Jamf, Hexnode, or ManageEngine
  • Windows Group Policy (GPO): built into Windows
  • Virtual desktops: Windows 365, Azure Virtual Desktop, or Amazon WorkSpaces
  • Enterprise browsers: Island or Talon
  • Web/DNS filtering: Palo Alto Prisma, Cloudflare One, or DNSFilter

Other safeguards

Other safeguards are acceptable if they meet the intent. Send us a message.

For Brokers For Funders Contact Us Sign In