Quality & Information Security Accreditations
M-Files operates an independently audited Quality and Information Security Management System backed by ISO and SOC certifications. Hosted on Microsoft Azure — with local Australian datacentres in Sydney and Melbourne — M-Files gives Australian organisations enterprise-grade data security, tamper-evident audit trails, and proven regulatory compliance.
Third-party certifications held by M-Files Corporation combined with Microsoft Azure infrastructure security provide Australian organisations with a tamper-evident, audit-ready information foundation.
Who Holds Which Certification? The Plain-English Breakdown
Compliance badges can easily get confusing. When evaluating document management or QMS software, it helps to understand who is responsible for what. The accreditations on this page fall into three simple buckets:
What M-Files is Certified For
Platform & engineering accreditations
M-Files Corporation is independently certified for ISO/IEC 27001, SOC 2 Type II, and ISO 9001. This proves they design, code, test, and run the M-Files platform — including M-Files Cloud, Hubshare, and M-Files Aino — under audited security and quality standards.
Where Your Data Lives
Microsoft Azure Australian datacentres
M-Files Cloud runs on Microsoft Azure, with domestic hosting in Sydney and Melbourne. Physical security, hardware redundancy, and disaster recovery are backed by Azure's own ISO 27018, ISO 22301, and ISO 27017 certifications, guaranteeing Australian data residency.
What M-Files Helps You Achieve
Out-of-the-box regulatory controls
When your business needs to pass an audit — whether for ISO 9001, FDA 21 CFR Part 11, GMP Annex 11, or the Australian Privacy Principles — M-Files QMS provides the automated version control, digital signatures, CAPA tracking, and audit trails required to satisfy your auditors.
Core M-Files Platform Certifications
M-Files operates an audited Quality and Information Security Management System covering platform engineering, cloud operations, and customer support.
ISO/IEC 27001:2022
Information Security Management (ISMS)
M-Files is certified by an independent third party against ISO/IEC 27001:2022. This Information Security Management System (ISMS) covers the engineering, maintenance, and cloud hosting of the entire M-Files platform — including M-Files Cloud, Hubshare client portals, M-Files Aino GenAI, and ongoing support operations.
ISAE 3000 (SOC 2 & SOC 3)
AICPA Trust Services Criteria
M-Files is certified under the ISAE 3000 standard based on the Trust Services Criteria of the American Institute of Certified Public Accountants (AICPA). This independent audit attests to robust operational controls around cloud system security, data availability, and processing integrity.
ISO 9001:2015
Quality Management System (QMS)
M-Files Corporation holds independent ISO 9001:2015 certification. This covers the entire lifecycle of how their software is designed, coded, tested, released, and supported — ensuring systematic quality across every release and cloud update.
VOI Certification (VCC)
Auditable Document Archiving
VOI is Germany's respected certification scheme for enterprise document management solutions (DMS). Holding a VOI Compliance Certificate confirms that M-Files has passed rigorous audits (often in cooperation with TÜV) for audit-proof digital archiving, tamper-evident storage, and GoBD compliance.
Records Management (EDRMS)
SÄHKE2, DoD 5015.2, AS ISO 15489
Certified under the National Archives of Finland's SÄHKE2 standard (Asianhallinta), M-Files delivers formal electronic records management. The platform also adheres to US DoD 5015.2, European MoReq2, and Australian Standard AS ISO 15489 for long-term records governance.
Modern Slavery Position
Supply Chain & Ethical Conduct
M-Files takes a zero-tolerance approach to modern slavery and human trafficking across its global business and supply chains. Operations strictly comply with the Australian Modern Slavery Act 2018 and UK Modern Slavery Act 2015, enforcing contractual human rights commitments across all vendor relationships.
Microsoft Azure Cloud Infrastructure Accreditations
M-Files Cloud is powered by Microsoft Azure, providing enterprise customers with state-of-the-art datacentre physical security, geo-redundancy, and high availability. For Australian enterprises, M-Files Cloud can be provisioned in Australian Azure regions (Sydney and Melbourne) to satisfy Australian data sovereignty and privacy mandates.
Australian customer vaults reside within Australian Microsoft Azure datacentres, ensuring compliance with Australian Privacy Principles (APPs) and the Privacy Act 1988.
ISO/IEC 27018 provides enhanced controls for public cloud service providers acting as Personally Identifiable Information (PII) processors. Microsoft Azure is certified to operate an Information Security Management System conforming to all ISO/IEC 27018 requirements, guaranteeing customer data is never used for commercial profiling.
ISO 22301 validates commitment to business continuity, redundant backups, and disaster preparedness. This certification demonstrates tested practices to prevent, mitigate, respond to, and recover from disruptive incidents, providing guaranteed uptime SLAs across cloud regions.
Used in conjunction with the ISO/IEC 27001 series of standards, ISO/IEC 27017 provides advanced technical security controls for cloud service providers, including virtual machine isolation, perimeter firewalls, and cloud administrator privilege management.
Privacy Mandates & Global Directives
M-Files embeds robust data protection, cyber resilience, and governance into everyday workflows.
GDPR & Australian Privacy Act (APPs)
M-Files complies with GDPR both as a data processor and as a data controller. As a processor, M-Files delivers technical safeguards, access control policies, and audit logging to assist customers in fulfilling Data Subject Access Requests (DSARs) and data retention rules under GDPR and the Australian Privacy Principles.
- • Data encryption at rest (AES-256) and in transit (TLS 1.3)
- • Automated retention policies and certified deletion
- • Full metadata-based role and object-level permissions
EU NIS 2 Directive
M-Files is committed to high standards of cybersecurity and data protection, maintaining the confidentiality, integrity, and availability of M-Files services and customer data in accordance with the NIS 2 directive for essential and important operating entities.
- • Proactive cybersecurity risk management processes
- • Incident reporting protocols & business continuity controls
- • Supply chain risk assessment across all integrations
DORA Resilience Framework
M-Files supports customers in the financial sector in achieving and maintaining compliance with the Digital Operational Resilience Act (DORA). As an ICT service provider, M-Files delivers resilient architecture designed to mitigate ICT disruptions, vulnerabilities, and third-party risks.
- • ICT incident management and automated event logging
- • Regular resilience and threat testing protocols
- • Third-party ICT contractual safeguards
Regulatory Frameworks Supported by M-Files QMS
How M-Files QMS and the M-Files Compliance Kit enable life sciences, medical device, healthcare, and financial enterprises to satisfy demanding regulatory audits.
FDA 21 CFR Part 11
M-Files QMS meets or supports all requirements of U.S. 21 CFR Part 11 for both electronic records and electronic signatures.
Features tamper-evident audit trails, dual-authentication signature triggers, manifestation of signatures (signer name, time/date, reason), and automated document version locks.
EudraLex Vol 4 Annex 11
M-Files QMS supports the mandates of EudraLex Volume 4, Good Manufacturing Practice, Annex 11: Computerised Systems.
Covers system validation requirements, audit logs, electronic signatures, and controlled standard operating procedures (SOPs) linked with employee training verification.
HIPAA Security Rule
M-Files promotes compliance with the U.S. Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule.
Supports both primary protected health information (PHI) repository security and use cases where M-Files functions as the QMS, SOP, and personnel credentialing vault.
SOX-404 & Internal Audit
The M-Files Compliance Kit extension is engineered and tested under M-Files' own ISO 9001 certified Quality System.
Guarantees strict segregation of duties, multi-stage approval pathways, tamper-proof version logs, and automated audit evidence collection for financial disclosures.
Compliance & Certifications FAQs
Common questions from Australian compliance managers, CISOs, and quality teams.
Are these certifications held by M-Files Corporation or Range?
The software platform certifications (including ISO/IEC 27001:2022, SOC 2 / ISAE 3000, ISO 9001:2015, and VOI certification) are held directly by M-Files Corporation, the software vendor. Range IS is an authorised Australian Premier Solutions Partner. We deliver certified implementation, architecture, training, and ongoing support to ensure your organisation's M-Files environment fully aligns with your compliance objectives.
Where is Australian customer data hosted in M-Files Cloud?
Australian customer vaults are hosted in Microsoft Azure's Australian Eastern datacentres (Sydney and Melbourne), guaranteeing full domestic data residency and adherence to the Australian Privacy Principles (APPs) and the Privacy Act 1988.
Does adopting M-Files QMS automatically make our business ISO or FDA compliant?
No software platform can make an organisation compliant on its own. Compliance requires both software controls and operational execution. M-Files QMS provides the validated technical controls — including electronic signatures, tamper-evident audit logs, automated revision histories, and CAPA workflows — while Range assists your team in implementing the local standard operating procedures (SOPs) needed to satisfy external auditors.
Can our audit committee or CISO request the official ISO certificates and SOC 2 reports?
Yes. Official copies of the ISO/IEC 27001 certificate, ISO 9001 certificate, and SOC 2 Type II audit attestations can be provided to prospective and existing clients under a standard Non-Disclosure Agreement (NDA) or via the official M-Files Trust Center. Contact Range to arrange audit documentation for your security evaluation.
Ready to Simplify Your Compliance & Audit Workflows?
Speak with an Australian M-Files specialist at Range. See how M-Files QMS and enterprise document management can automate your ISO, regulatory, and information governance mandates.