HSBC uses Microsoft Power Platform, Dynamics 365, and Microsoft Dataverse as the foundation for securely storing, analyzing, and protecting critical financial data across more than 50 markets.

Key ways HSBC protects sensitive data include:

• Dataverse security and privacy standards – Dataverse is built on comprehensive security and privacy controls, which HSBC uses to safeguard customer data across multiple business lines and meet strict internal and regulatory requirements.
• Fine-grained access and control – Security features give HSBC better control and transparency over who can access which data, and under what conditions, supporting both internal policies and external regulations.
• Support for highly regulated workloads – Power Platform helps HSBC protect workloads that store highly sensitive data and require additional security controls, so teams can still build low-code solutions without compromising compliance.

By combining these capabilities, HSBC can reimagine how it delivers digital services while maintaining the level of protection expected from a global financial institution serving millions of customers.

HSBC relies on several advanced Power Platform security features to let teams innovate while staying within strict banking regulations:

• Virtual Network (VNet) support
  VNet support lets HSBC control data egress from Power Platform and keep communication on a private network instead of the public internet. This:
  • Enables secure connections to Azure resources without installing and maintaining gateways.
  • Unlocks integrations that would not be feasible over the public internet.
  • Allows HSBC to optimize sizing, performance, and utilization of the delegated subnet for both efficiency and security at scale.
• Customer-managed keys (CMK)
  CMK gives HSBC control over data encryption at rest by allowing the bank to use its own encryption keys. This helps HSBC:
  • Meet data and privacy regulatory requirements in a cost-effective way.
  • Configure access controls based on specific financial industry needs.
  • Support long-term data retention, Dataverse search index, Copilot search index, AI Builder, and more.
  • Rotate or swap encryption keys on demand and decide how many keys to use, where, and when.
• Subnet delegation
  Used together with CMK, subnet delegation helps HSBC gain cloud benefits while maintaining rigorous security, balancing performance and protection.

These capabilities allow subject matter experts across HSBC to build and deploy solutions in a secure, controlled environment, reshaping how the bank approaches low-code innovation.

To maintain privacy, transparency, and compliance, HSBC combines multiple Power Platform features and governance practices:

• Customer Lockbox for Power Platform
  Customer Lockbox adds an extra layer of control over data access. If Microsoft engineers ever need to access HSBC’s data in environments like Dataverse for support or troubleshooting, they must obtain explicit approval from HSBC first. This ensures:
  • Access is tightly managed and fully auditable.
  • Sensitive data is not accessed without direct customer involvement.
  • Stronger alignment with privacy regulations and internal policies.
• Consistent security for AI and Copilot workloads
  Microsoft’s CMK support now extends to Copilot Studio, so data used in Copilot scenarios follows the same encryption and key management policies as other workloads. This helps HSBC bring secure, scalable AI into the flow of work without creating security gaps.
• Multi-layered security partnership
  HSBC and Microsoft work together to design and operate multiple layers of security within Power Platform, tailored to the demands of financial services. This includes encryption, network isolation, access controls, and auditable processes.

With these measures, HSBC gains the visibility and control it needs to support a culture of secure collaboration and innovation, while continuing to meet the expectations of regulators and customers.