How Files.com Handles Customer Data

Files.com treats customer data as confidential by default. We process file contents for customer-authorized operations, do not use customer data for marketing or sales, and apply tightly controlled internal access policies to the systems that store it. This page describes those practices and the responsibilities that fall to the customer under our Shared Responsibility Model.

Customer Data Handling

Files.com does not view, scan, or process the contents of customer-uploaded files unless the customer explicitly authorizes it. Malware Scanning, Content Validation, and TransformScript all work this way. Requested previews, editing, encryption, and other file operations also process contents as needed to perform that work. AI features have additional provider-processing and chat-access practices described separately.

Customer Data Classification

Files.com cannot know what data you store in the platform. Classifying that data, including identifying whether it contains sensitive information such as PII, PHI, or copyrighted material, is your responsibility as the customer. See the Shared Responsibility Model for the full split.

Metadata Access for Support and Operations

Files.com Customer Support and Engineering staff may access configuration settings, logs, and file metadata to troubleshoot issues and ensure system stability. Access is tightly controlled, logged, and granted only as needed. Some logs and feature transcripts can include file contents or other customer-supplied information, so administrative records must not all be treated as metadata-only. Access to file contents follows the customer-authorization practices above; AI chat access is described in the AI disclosure.

Internal Data Access is Strictly Controlled

Only select senior, U.S.-based engineers have root access to production systems. These employees are full-time, background-checked, and bound by confidentiality agreements. Root access is not granted until at least one year of tenure, or else executive approval. All direct access is logged.

Multi-Tenant Isolation

Customers share the underlying Files.com infrastructure, while access controls keep each customer's data and configuration logically separate. Files.com applies same-day corrections for critical security issues in shared request-processing components, with changes tested before deployment. Customer Isolation explains Site and Workspace boundaries, administrative access, and intentionally granted access between them.

Customer-Controlled Storage and the Agent

The Files.com Agent can perform file operations in your environment while Files.com continues to provide authentication, permissions, and administration. The transfer and processing path determines where file contents travel and where temporary copies are required.

The Agent is part of ITAR-aligned and CGR-aligned configurations. Work with your Account Executive and Onboarding Engineer to plan the deployment, identify the operations performed in your environment, and configure the connections that remain in the cloud.

Encryption in Transit and at Rest

Files.com Native Storage encrypts customer file contents at rest using AES-256. Web and API connections use HTTPS with TLS, while SFTP uses SSH encryption. Optional insecure FTP and certain Custom SMTP modes permit unencrypted transmission; customers must enforce encrypted connections when their requirements call for them. Customer-controlled GPG encryption protects file contents separately. Data Encryption & Key Management explains these controls and exceptions.

Customer Data Storage and Redundancy

Files.com Native Storage stores customer file contents in the Amazon S3 Simple Storage Service. Objects are redundantly stored across multiple devices and facilities within an Amazon S3 Region. Amazon S3 regularly verifies data integrity using checksums and repairs any corruption using redundant data.

Metadata Storage and Backup Retention

Files.com stores customer metadata in Amazon Aurora. Multiple hot-backup servers operate across availability zones, and point-in-time restore capabilities are available for the prior 7 days. Full database snapshots are stored in Amazon S3 every 24 hours and retained for at least 7 days. Backups are audited as part of the Backup and Restoration Test Procedure.

Global Acceleration and Data Routing

To improve performance, customer-uploaded data may first pass through the region closest to the user before being stored in the selected storage location. Customers can configure Global Acceleration to use their selected region. That setting does not determine every Remote Server connection, temporary processing location, or record location. Data Location & Processing explains the complete review, including logs and AI providers.

No Use of Customer Data for Marketing or Sales

Files.com does not sell customer data or use it for advertising purposes. Device identifiers such as cookies or IP addresses may be used on the public website for analytics and marketing, but this data is not tied to customer-uploaded files and is handled in accordance with applicable privacy laws.

Legal Requests and Disclosure Process

Files.com complies with lawful data disclosure requests under applicable jurisdiction. Our Privacy Officer reviews every request and handles it in accordance with our Privacy Policy.

ICO Registration

Files.com is not registered with the UK Information Commissioner's Office (ICO). Files.com's business operations do not require registration under current UK data protection law.

Registration status is separate from the agreements and transfer safeguards governing personal-data processing. Our privacy agreements and international transfer safeguards describe the DPA and UK International Data Transfer Addendum relevant to customer reviews.

Privacy Oversight and Contact

Files.com's Privacy Officer is Chief Legal Counsel Chris Chaffin. For privacy-related inquiries, customers may contact: privacy@files.com.