Streamlining Customer Content Management with Box: Our Journey to Centralisation & Efficiency

By Ping Liu, Principal Engineer — Notifications & Content at Macquarie Bank

The Challenge of Managing Content at Scale

In large organisations, customer document storage is often spread across platforms like AWS S3, Google Cloud Storage, SharePoint, Salesforce and more. Each of these platforms has its own rules, access controls, and compliance requirements. This fragmentation turns simple requests, such as deleting a customer document, into complex, multi-step processes. These processes involve manual discovery, legal checks, platform-specific actions, audit logging and requirements, and downstream dependencies. Finding where a document is stored is just the beginning. This not only slows down operations but also introduces inconsistency, increases risk, and makes governance difficult at scale.

As our organisation grew, we faced growing challenges to have better understanding of customer behaviour and insights. Engineers managed multiple vendor integrations and upgrades, while teams struggled with tool selection and management, leading to duplicating effort and confusion. Business costs rose due to overlapping functionalities and scattered data, and collaboration was hampered by versioning and redundant file storage.

To address this, our project was launched to build a centralised document management system. The goal is to abstract away platform-specific complexities and deliver a unified, secure, and scalable interface for managing customer document and forward compatible with upcoming AI-enabled features. This is about more than simplifying storage — it’s about better governance, enhanced customer experience, nimbler operations and shorter processing times, and greater trust in how we manage critical customer data across teams and platforms. This foundation also sets the stage for future capabilities and innovation.

Content Cloud Solution

Macquarie has explored numerous content management solutions and currently uses several within our organisation. Instead of developing a new system, we opted to build our Content Management platform based on a Content Cloud SaaS (Box.com) as it’s core features and capabilities suit our needs:

How We Utilise the Content Cloud

Our adoption of The Content Cloud focused on following key areas:

Centralised Customer Document Management

• We establish structured folders, catering to multiple customer applications and their domain app user groups. This approach not only enhances user access control and documents retrieval but also ensures scalability as we grow. We have implemented different folder structures to organise documents based on various business needs. For instance:
• Loan Application Documents: Organised by their associated application, with all documents related to a specific loan application grouped together. This makes it easier to manage the application as a whole.
• Statement Documents: Organised by their associated customer, with all documents related to a specific customer grouped together.
• Shard User Pool: To manage Box’s storage and API capabilities efficiently, we utilise a domain app user pool. This ensures resource-efficient use and optimal performance.

Note: An app user is a type of user that does not have login credentials and is only accessible via API. It is created by a service account in the Content Cloud system and is only applicable to applications leveraging server to server authentication. App Users are tied to the application used to create them, and while they can collaborate on content outside of the application, the user itself cannot be moved under another application.

Access Control

We ensure secure file operations by leveraging downscoped tokens, which restrict access both in scope and duration. This ensures the principle of least privilege. For example:

• Upload tokens are limited to specific locations and cannot be used to download files. The token is short-lived for a short time window.
• Download tokens are tied to individual files and expire within a defined time window.

Note: A downscoped token is a type of access token used in the Content Cloud system. Unlike the original token, which has full access to all files, a downscope token is a child token with fewer permissions (scopes). It is designed to provide limited access to a specific file or a folder. Essentially, the scoped tokens enhance security by granting only the minimum necessary permissions required for a particular task or integration.

Enhanced Security

Uploaded files first land in a dedicated staging area, where they undergo initial validation before being moved to a secure location. Access to documents is gated by entitlement checks to ensure that customers can only retrieve files they are authorised. Our plugin-based architecture adds an extra layer of protection, with built-in support, e.g file MIME type detection and malware scanning.

Looking ahead, the design anticipates future enhancements such as PII detection and text redaction, reinforcing our long-term security posture.

API-First Architecture

Our solution is built on a clean, API-first approach, exposing simple upload and download endpoints utilising the Content Cloud’s event streaming capabilities. Users interact with a consistent, simplified API layer while we manage the underlying complexities of document storage, organisation, and compliance behind the scenes. This abstraction allows teams to stay focused on their tasks without needing to understand Content Cloud’s internals.

Pluggable architecture

Our solution features a pluggable architecture that allows the platform to grow in an organised way without impacting the existing users and services. New capabilities can be added as independent plugin, ensuring seamless extension of functionality to meet evolving business needs and compliance requirements. Once a new capability is integrated into the system, any user can start using that capability without the need of a new release. Users have the option to either request the process function on a per-file basis or for all files they upload. This approach maintains system stability and user experience, supporting current needs and also future-proofs the platform for adapting new requirements and technologies.

The Benefits of Centralisation

Since the project went to production, we’ve observed potential improvements in many areas:

• Single Source of Truth: Centralisation offers a single source of truth, making it easier to locate files and apply business processing workflows. For instance, integration with AI capabilities becomes streamlined, eliminating the need for point-to-point integration. Once a business capability is integrated into the system, it can be easily utilised by other teams to incorporated within their customer journey with little to no additional effort.
• Security & Access Control: Centralisation simplifies document management, making it easier to apply controls on documents for compliance requirements. e.g., apply retention policies or legal holds. This ensures that security and access control are maintained effectively.
• Drive Content Insight: Having one source of truth makes it easy to use these extra features provided by the Content solution within our workflow, such as usage analytics and user activity tracking. These insights help us understand how content is accessed, who uses it and when — enabling smarter, data driven business decisions.
• Cost Savings & Efficiency: By storing all customer documents on the same platform, it becomes highly efficient to utilise other capabilities provided by the Content Cloud solution, such as document generation and document digital signing. This can lead to significant cost savings. Utilising a single platform simplifies integration processes, reducing the time and resources needed to manage multiple systems, resulting in improved operational efficiency and engineering experience.

Key Takeaways & Future Enhancements

Adopting our customer content platform required careful planning and some change management. Here are some key takeaways and future enhancement plans.

Key Takeaways

• User adoption matters. Collecting and acting on user feedback during the initial stages of adoption helped in making necessary adjustments and improving user satisfaction.
• Balancing Security and Usability. Striking the right balance between security measures and ease of use is an ongoing process. Initial configurations required adjustments to ensure that users had the necessary access without compromising security.
• Phased Implementation. Adopting a phased approach to implementation allowed us to address issues incrementally and make improvements based on real-time feedback.
• Content Architecture Files are organised and structured to closely align with business channels and products. This ensures clear physical separation and prevents potential misuse.
• Designate File Transfers between the customer and the server. This reduces our infrastructure usage and leverages vendor’s cloud system optimisation.

Future Enhancements

• New adoption and new capabilities — Onboard more users to use this platform. Explore new capability and new business workflows
• Automation is the next step — We’re exploring ways to automate the integration and adoption process to enhance efficiency. Currently, there are several manual steps involved, which can be streamlined to save time and reduce errors.

Conclusion — More Than Just Storage

Customer Content Management isn’t just about a file storage solution — it’s about building trust, traceability, and scalability into how we manage critical customer data. The goal is to deliver a more intelligent, governed, and user-friendly way to manage documents — across platforms, teams, and use cases.

Disclaimer:

This information has been prepared for general information purposes only. Before acting on this information, you must consider its appropriateness having regard to your own objectives, situation and needs. The information provided is not intended to replace or serve as a substitute for any professional advice, consultation or service. The information is based on information obtained from sources believed to be reliable, but Macquarie makes no representation or warranty that it is accurate, complete or up to date. Macquarie accepts no obligation to correct or update the information or opinions in it, and any opinions expressed are subject to change without notice. Box and other third party platforms or software vendors mentioned in this article are not affiliated with Macquarie. Macquarie does not endorse them and does not receive any commission or benefit if you choose to use these tools. © Copyright is reserved throughout.