How to create a Secure Vault
Secure Vaults are isolated, encrypted containers for your most sensitive documents — with their own access policy and data residency. This guide walks through creating one from scratch, choosing US or Swiss residency, setting a least-privilege access policy, and inviting reviewers.
A Secure Vault is the strongest boundary merlon offers around a set of documents. Unlike an ordinary folder, a vault has its own encryption scope, its own access list, and its own data-residency setting. That makes vaults the right home for personnel files, board materials, patient documentation, or any collection where "who can see this" and "where does it live" must be answered precisely and provably.
You can create as many vaults as you need. A common pattern is one vault per sensitive domain — for example a Swiss-resident HR vault, a US-resident Investor vault, and a Legal hold vault — each with a different access list. This guide creates a single vault end to end; repeat the steps for each additional one.
Before you begin
It helps to have three answers ready:
- Purpose — one sentence describing what belongs in this vault (drives naming and later audits).
- Residency — US (US-east-1) or Switzerland (CH-eu-1). This cannot be changed after creation.
- Access list — the smallest set of people or groups who need the documents.
Step 1 — Open the Vaults area
From your workspace, select Vaults in the left sidebar, then click New vault in the top-right. If you manage more than one organisation, confirm the correct one is selected in the workspace switcher first — a vault always belongs to a single organisation and can't be moved between them later.
Step 2 — Name the vault and set its purpose
Give the vault a clear, human name — HR — Restricted is better than Vault 3. The name appears in audit logs and access reviews, so a descriptive name saves time later. Add an optional purpose description; this is shown to anyone you invite and helps reviewers understand why they have access.
Step 3 — Choose data residency
Select where the vault's documents and their encryption keys are stored. merlon offers two regions: Switzerland (CH-eu-1) for Swiss/EU data-residency needs under nFADP and GDPR, and United States (US-east-1) for US customers. Residency is set per vault, so an HR vault can live in Switzerland while a US sales vault stays in the US — within the same organisation.
Step 4 — Set the access policy
A vault starts with no members except its owner. Add access by group wherever possible rather than by individual — for example grant the HR Team group rather than four named people. Group-based access means new HR hires inherit the right permissions automatically, and leavers lose them the moment they're removed from the group.
For each member or group, choose a role: Viewer (read and download), Contributor (add and version documents), or Vault Admin (manage access and settings). Apply least privilege — most reviewers need Viewer, not Contributor.
Step 5 — Configure retention and legal hold
Set how long documents are kept and what happens when that period expires. A retention policy can automatically delete documents a defined time after their last activity — useful for candidate data you must minimise under nFADP and GDPR — or retain them for a fixed period, such as seven years for signed contracts.
You can also enable legal hold, which freezes every document in the vault against deletion, overriding any retention rule, for litigation or regulatory review. Applying and lifting a hold is itself recorded in the audit trail.
Step 6 — Invite reviewers
With the vault created, invite anyone who wasn't covered by a group. Each invitee receives an email; on first access they must satisfy the workspace's authentication policy — MFA, or SSO if your organisation uses it. Invitations expire after seven days by default and every acceptance is logged.
Step 7 — Add your first documents
Drag documents into the vault, or use Import to pull from a connected storage source such as SharePoint or Google Drive. Every document is encrypted with AES-256 under the vault's regional keys the moment it lands, and each upload creates the first entry in that document's version history. From here you can request e-signatures, start an approval workflow, or share a document with an expiring link — all within the vault's boundary.
Create a vault via the API
Everything above can also be scripted. The example below creates a Swiss-resident vault and grants a group Viewer access in one call. Point requests at the regional base URL that matches your desired residency.
curl -X POST https://api.eu.merlon.ch/v1/vaults \
-H "Authorization: Bearer $MERLON_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"name": "HR — Restricted",
"purpose": "Personnel files & contracts",
"residency": "ch-eu-1",
"access": [
{ "group": "hr-team", "role": "contributor" },
{ "group": "legal", "role": "viewer" }
],
"retention": { "mode": "retain", "years": 7 }
}'See the full API Reference for the vaults resource, error codes, and webhook events such as vault.created.
Troubleshooting
- I can't see the “New vault” button
- You need the Vault Admin or Organisation Admin role. Ask an administrator to grant it, then reload. If the whole Vaults sidebar item is missing, vaults may be disabled on your plan.
- The residency I want isn't listed
- Only the regions enabled for your organisation appear. Enterprise customers can request an additional region — contact Support to enable it before creating the vault.
- An invitee can't accept their invitation
- Invitations expire after seven days and are single-use. Re-send from the vault's Invitations panel. If they're blocked at sign-in, confirm they can satisfy your MFA/SSO policy.
- Import from storage failed
- Check the storage integration is still connected under Integrations, and that the connecting account has read access to the source folder. Re-authorise the connection if it shows as expired.
Related articles
Choosing US or Swiss residency per vault
How to decide which region each document type belongs in.
ReadDefine roles & least-privilege policy
Build a role model that keeps access tight without slowing people down.
ReadExporting a complete audit trail
Produce defensible, tamper-evident evidence for an audit in a couple of clicks.
ContactConfigure retention & legal hold
Automate deletion and freeze documents when a matter goes to litigation.
ReadImporting documents from storage
Pull files in from SharePoint, Google Drive or Dropbox into a vault.
ContactBrowse the Help Center
All categories, popular articles, and the full knowledge base.
Open