What’s the safest way to collect and store vendor W-9s, banking details, and SSNs?

The biggest exposure often happens during collection. A vendor-sent W-9 can end up in the vendor’s sent mail, your mailbox, retention systems, and backups. A secure upload portal that sends the file directly into controlled storage is preferable to email, and staff should have a process for securely handling and deleting anything that arrives by email.

Also minimize what you collect. For many sole proprietors, an EIN may be acceptable instead of an SSN, depending on the tax and payment requirements. The safest sensitive field is the one you don’t need to hold.

SharePoint can work if it’s treated as a restricted system rather than just another folder. Use a separate site with its own membership group, limit access to the people who actually need it, require MFA and compliant devices, enable auditing, apply sensitivity labels with encryption, configure retention and deletion rules, and review access regularly. Avoid putting this material inside a broadly accessible team or shared library.

The intake process is just as important as the storage. Email attachments and ordinary form responses can leave sensitive copies in mailboxes, archives, backups, or response lists before your storage protections apply. Use a secure vendor upload workflow instead. Also establish a documented callback procedure for ACH changes: verify changes using a trusted phone number already on file, never only the contact information included in the change request.

Whatever platform you choose, write down the complete lifecycle: what information is required, who can access it, how it is encrypted, how access is logged, how long each document is retained, and how it is securely deleted. Include periodic permission reviews and a tested incident-response process. Those operational controls matter as much as the product name.

A dedicated encrypted vendor portal or document-management system can simplify secure collection, automatic access controls, audit trails, retention, and deletion. It may be worth the cost if you have a large vendor base or need stronger workflow and compliance features.

If you stay with Microsoft 365, make sure you understand the limitations of your chosen intake method. A restricted SharePoint library is not automatically a public upload portal, and external users should not receive broader site access just to submit one document. Use a supported submission workflow that keeps permissions narrow and prevents files from being exposed to other vendors.