Skip to main content

Vendor Management & Oversight

Files.com manages vendor relationships through a formal Vendor Management Program that evaluates risk, maintains continuity, and holds vendors to the same security and availability standards we apply internally. Vendor oversight is part of our Risk Management Program and is reviewed annually as part of our SOC 2 Type II audit.

Vendor Risk Management Program

Vendor risk is assessed as part of Files.com's broader Risk Management Program, which follows the COBIT 5 framework. All vendors are evaluated for potential impacts to the confidentiality, integrity, and availability (CIA) of systems and data. Vendors are assigned a risk tier at onboarding. High- and Medium-risk vendors are reviewed annually; Low-risk vendors are reviewed every two years, with additional review when circumstances require it. Critical vendors are included in the company's Risk Register. Security clauses are included in all critical provider contracts.

Files.com maintains a Vendor Risk Management policy that covers:

  • Security documentation review for critical vendors
  • Ongoing risk assessments for vendor relationships
  • Centralized tracking of vendor risk in the Risk Register
  • Integration of vendor oversight into organizational risk treatment

Oversight of Critical Vendors

Amazon Web Services (AWS) is a critical infrastructure vendor and provides platform hosting, including server instances, storage, and databases. This hosting relationship is separate from feature-specific processing: the AI Assistant and AI Tasks use AWS, Anthropic, and OpenAI, and may process file contents and account information through those providers. AI data handling describes the information involved and the customer controls.

A review should distinguish Files.com infrastructure, enabled processing features, services used for company operations, and systems connected by the customer. A customer-selected identity provider, storage system, or integration platform has its own contract and operating responsibilities. The Shared Responsibility Model describes that boundary.

Files.com reviews AWS's SOC 2 report at least annually. As of the most recent review, no deficiencies were noted. NDA restrictions prevent us from providing a copy of the AWS SOC 2 report directly. AWS's security controls are independently audited and documented through their published compliance programs.

Our agreement with AWS requires compliance with the Files.com Privacy Policy and includes contractual obligations around data handling and security practices.

Vendor Continuity Planning

Files.com maintains a contingency plan to replace any critical vendor when necessary. Based on our most recent risk assessment, none of our current vendor relationships represent a material risk. Alternate vendors have been identified and evaluated so that operations continue in the event of service disruption or vendor unavailability.

Vendor Onboarding and Access Policies

Files.com does not currently engage contractors or external vendors for internal access roles. Company policy requires that any future vendors or contractors follow the same onboarding, pre-screening, and access control procedures as full-time employees. This includes background checks, confidentiality agreements, and completion of security awareness training before they receive access to any internal systems.

No vendor receives privileged access to Files.com infrastructure without formal approval and security review.