HSBC uses Microsoft Power Platform, Dynamics 365, and Microsoft Dataverse to securely store, analyze, and protect critical financial data across multiple business lines.

Key elements of their approach include:

• Dataverse security and privacy standards – Dataverse is built on comprehensive security and privacy controls, which HSBC relies on to safeguard customer data and meet internal and external regulatory requirements.
• Virtual Network (VNet) support – VNet support gives HSBC control over data leaving Power Platform. Data traffic can be kept on a private network instead of the public internet, which is especially important for a bank operating in over 50 markets and serving millions of customers.
• Customer-managed keys (CMK) – HSBC manages its own encryption keys for data at rest. This lets the bank define how sensitive data is encrypted, rotated, and governed, aligning with strict financial services regulations.
• Customer Lockbox – Any access by Microsoft engineers to HSBC’s Power Platform data (for support or troubleshooting) requires explicit approval from HSBC and is fully auditable, adding another layer of control and transparency.

Together, these capabilities help HSBC strengthen data protection, improve control and transparency, and support secure innovation in a highly regulated environment.

HSBC’s goal is to let subject matter experts solve problems with low-code tools while keeping security and compliance front and center. They do this by combining Power Platform’s governance features with network and encryption controls.

Key practices include:

• Virtual Network support for secure connectivity – Power Platform Virtual Network support lets HSBC route traffic over a private network instead of the public internet. This unlocks integrations that would otherwise be blocked for security reasons and removes the need to install and maintain multiple gateways.
• Optimized delegated subnets – With the latest enhancements, HSBC can tune the sizing, performance, and utilization of delegated subnets. This helps maintain both efficiency and security as workloads scale across the organization.
• Consistent security for AI and search workloads – Features like CMK now extend to Copilot Studio, Dataverse search index, Copilot search index, and AI Builder. That means AI-driven experiences follow the same security and compliance policies as core data.
• Culture of secure experimentation – HSBC encourages hands-on problem solving and uses Power Platform’s security capabilities to create a controlled environment where teams can build and iterate without exposing sensitive data.

This combination allows HSBC to reimagine workflows, optimize processes, and drive efficiency while staying aligned with strict financial regulations.

Customer-managed keys (CMK) and Power Platform Customer Lockbox are central to how HSBC aligns cloud innovation with rigorous compliance and privacy expectations.

Customer-managed keys (CMK)

• CMK lets HSBC use its own encryption keys to protect data at rest in Power Platform and Dataverse.
• This gives the bank greater control over encryption—including how keys are created, stored, rotated, and retired—helping meet data and privacy regulatory requirements in a cost-effective way.
• Compared to older bring your own key (BYOK) models, CMK supports long-term data retention and advanced capabilities such as Dataverse search index, Copilot search index, AI Builder, and now Copilot Studio.
• HSBC can rotate or swap encryption keys on demand and decide how many keys to use, where to apply them, and when, aligning with its internal security standards.

Power Platform Customer Lockbox

• Customer Lockbox adds an extra layer of control over data access in environments like Microsoft Dataverse.
• If Microsoft engineers ever need access to HSBC’s data for support or troubleshooting, explicit approval from HSBC is required before access is granted.
• All such access is tightly managed and auditable, which strengthens trust and supports compliance with privacy regulations.

Together, CMK and Customer Lockbox help HSBC rethink how it uses the cloud: the bank gains the benefits of scalable, intelligent platforms while maintaining the stringent security, privacy, and audit controls expected in financial services.