Audits & Assurance
Independent reports, certifications, and provider assessments help you evaluate the service and company your organization relies on. They support vendor selection, renewals, contractual reviews, and your own auditors' work. The useful evidence depends on the question: an examination of controls over time, a government certification for an identified offering, and a provider's completed questionnaire establish different things.
Read each item against its defined scope. Identify the service, system, criteria, examination period, and conditions it covers, including any controls your organization or another provider must operate. These distinctions let you incorporate Files.com's assurance into your control environment and identify where additional evidence is needed. Regulatory & Industry Requirements explains obligations and conditions relevant to particular customer activities.
Selecting Evidence
Match the request in your review to the assurance it requires. A contractual requirement for a particular certificate or report should be evaluated using that document's actual scope and terms.
| Evidence or program | Relevant when | Files.com's position |
|---|---|---|
| SOC 2 Type II | Your vendor review or auditors need independent evidence about the design and operating effectiveness of service controls over time. | Annual examination covering Security, Availability, and Confidentiality; report and bridge letter available under NDA. |
| FedRAMP | A federal agency or supporting contractor needs a certified cloud offering for the planned use. | FedRAMP 20x Class A Certification for the offering described in the Certification Package; the required federal tenant configuration applies. |
| CAIQ / STAR Level 1 | Your cloud-provider review requests standardized Cloud Security Alliance control responses. | Completed CAIQ v4 self-assessment, available under NDA. |
| Government compliance programs | An agency's procurement requirements identify a particular authorization or approved-vendor program. | Existing FedRAMP certification; no current StateRAMP or TX-RAMP authorization. Sponsorship is welcome. |
| Accessibility assessment | Procurement or accessibility reviewers need criterion-level findings and tested product scope. | Annual independent assessment of the logged-in web application; VPAT available under NDA. |
| EU–U.S. Data Privacy Framework | A privacy review asks about participation and the basis for international transfers. | EU–U.S. certification; UK and Swiss transfers use the separate contractual safeguards described in the privacy reference. |
| FIPS 140-3 | A policy or contract requires validated cryptographic modules for particular operations. | AWS KMS hardware security modules supply an inherited validation for file encryption at rest; validation does not cover every Files.com module. |
| ISO/IEC 27001 | Your procurement policy requires an information security management system certificate. | Certification is a future goal; discuss a mandatory certificate requirement with your account team during evaluation. |
The Trust Center provides the available evidence catalog. Document Requests explains eligibility, confidentiality requirements, and request routes. Public certification disclosures and signed agreements have their own scope and access rules.
Independent Examination and Self-Assessment
An independent examination adds an external auditor's evaluation of the controls and evidence within its scope. A Type II examination also evaluates operating effectiveness over a defined period. Review the opinion, any findings, and complementary customer and subservice-organization controls in the report.
A self-assessment records the provider's responses to a defined set of questions. It can make a detailed review more consistent and efficient, and can identify where supporting evidence is needed. Files.com's CAIQ is a STAR Level 1 self-assessment; it is distinct from an independent certification or attestation.
FIPS 140-3
A FIPS requirement usually concerns a particular cryptographic module and its validated configuration. Identify which operations your requirement covers, such as file encryption at rest or encrypted network connections. The algorithm name or key length alone does not establish module validation.
Files.com does not operate all cryptographic modules in a FIPS-validated configuration. AWS Key Management Service hardware security modules provide a FIPS 140-3 Security Level 3 inherited control for customer file encryption at rest; that validation does not extend to every transport module or to the whole Files.com platform. The cryptographic-module disclosure identifies the modules, their uses, and their validation status.
ISO/IEC 27001
ISO/IEC 27001 addresses an organization's information security management system. If your procurement process requires certification, review whether the certificate's organizational and service scope covers the proposed arrangement.
Files.com intends to pursue ISO 27001 certification in the future. Our SOC 2 report supplies separate assurance about its stated controls and examination period. If your organization requires an ISO 27001 certificate, raise that specific requirement with your account team during evaluation.