HSBC drives innovation in Power Platform security

With our lives increasingly conducted online, cybersecurity has become one of the most critical challenges organizations face. Sensitive data, from healthcare to education and banking, is constantly in motion, demanding robust protections to safeguard it. HSBC, one of the world’s largest and most elite financial institutions, stands as a leading example of innovation in the banking industry. By leveraging Microsoft Power Platform and Dynamics 365, HSBC securely stores, analyzes, and protects critical data.

Microsoft Power Platform stands as the trusted low-code solution for even the most security-conscious industries, including leading financial institutions like HSBC, which serves millions of customers in over 50 markets.

With Microsoft Dataverse built on comprehensive security and privacy standards, HSBC uses its advanced features to safeguard customer data across multiple business lines, ensuring robust protection and compliance throughout the organization. This is critical because, as a financial services organization, HSBC must meet internal security standards that take into account compliance and regulatory requirements.

HSBC is proud of its strong culture of innovation and encourages hands-on problem solving. Security features like Virtual Network support ensure the bank has control over data egressing from Power Platform, enabling innovation by subject matter experts in a secure and controlled environment. “Innovation is at the heart of HSBC’s ethos, a value that resonates with our vision at Microsoft,” says Ritesh Pandey, Principal Program Manager, Microsoft.

“Power Platform’s advanced security features, such as virtual network support, empower HSBC to pioneer solutions that redefine banking. Microsoft’s global deployment strategy ensures that innovation thrives, securely and efficiently.”

Enabling secure communication through a private network is vital for HSBC to empower its teams, optimize workflows, and drive efficiency across the organization. Power Platform Virtual Network support unlocks integrations that would be impossible to route over the public internet and allows secure connections to Azure resources via a private network instead of using valuable time and effort to install and maintain gateways. With the latest enhancements, HSBC can now also ensure optimal sizing, performance, and utilization of the delegated subnet, maintaining both efficiency and security at scale.

Data encryption at-rest is another vital security parameter for highly regulated industries, and equipping customers with the ability to manage their own encryption key is equally important. Customer-managed keys (CMK) allow customers to use their own encryption keys to protect their data within the platform. This feature enhances data security and provides organizations with greater control over how their sensitive data is encrypted and managed. “CMK allows customers to meet their data and privacy regulatory requirements with greater control over the security of their data in a cost-effective way,” says Paul Liew, Principal Program Manager Dataverse, Microsoft.

Customers like HSBC use CMK to configure access controls based on the specific requirements of the industry while offering benefits over the old bring your own key (BYOK), including support for long-term data retention, Dataverse search index, Copilot search index, AI Builder, and more. Microsoft’s CMK support now also extends to Copilot Studio. This ensures that Copilot Studio data aligns with the same security policies. “CMK and subnet delegation ensure we reap the benefits of the cloud while practicing the most rigorous security measures,” says Wael Hamze, Power Platform Lead, HSBC.

Power Platform’s CMK support enables workloads to rotate/swap the encryption key on demand. Consistent with the highest encryption standards, this feature also gives customers like HSBC full control and flexibility over how many keys it wants to use, where to use them, and when.

Microsoft has been a key partner in developing the many layers of security within Power Platform that HSBC’s industry demands. Power Platform Customer Lockbox is a feature designed to enhance data privacy and control by ensuring that access to HSBC’s data in Power Platform environments, such as Microsoft Dataverse, is tightly managed and auditable. It provides an additional layer of security and transparency by requiring explicit customer approval before Microsoft engineers can access their data for support or troubleshooting purposes. By enabling Lockbox policies, HSBC ensures sensitive data is not accessed without direct customer involvement, strengthening trust and compliance with privacy regulations. Overall, Power Platform security features give HSBC the confidence to innovate securely. Power Platform also helps the organization protect workloads that store sensitive data and require additional security controls.

HSBC is excited to strengthen its partnership with Microsoft as it adopts advanced security features that provide enhanced visibility and control. These innovations will enable HSBC to continue fostering its distinctive culture of secure collaboration and innovation, reinforcing its leadership in the financial industry.