Securing the growing volumes of data that employees keep in cloud-based services such as Office 365 has emerged as one of the greatest challenges for CIOs, but it still pales in comparison to the difficulty of protecting those documents once they move elsewhere from there. That’s the problem Vera Inc. has now set its eyes on addressing.

The startup hopes to accomplish that with the addition of direct support for Microsoft’s hugely popular productivity platform to its namesake data protection technology, which takes a unique approach to protecting corporate information outside the firewall. Rather than enforcing security policies on the environment where files are stored, Vera applies controls to the files themselves.

That’s achieved using special code attached to each Office 365 document with definitions for how and when its contents can be accessed, which can vary greatly depending on the need. The draft of an upcoming product announcement, for example, can be watermarked as such to make clear that it’s not yet ready to publish, while more sensitive documents such as monthly sales reports are assigned much tighter restricts.

It’s the latter scenario where Vera truly shines. Its service makes it possible to protect important files with military-grade encryption and require employees to verify themselves using company-provided credentials before unscrambling the contents. Organizations can also control how users interact with a given document after they’ve confirmed their identity,  down to which parts they’re allowed to copy onto their clipboards.

That usage is tracked and displayed in a centralized console that provides information on which administrators can act to prevent abuse. If, for instance, an worker is found to send a document from a sensitive Office 365 folder to an address not registered with the company, the security team can shut off access remotely and identify the location of the recipient if they try to open it.

The integration with Microsoft’s managed productivity suite joins existing support for the on-premise version of Word, Dropbox, Box and a number of other popular cloud services. The functionality is available immediately.