Files.com maintains an Information Security Program (InfoSec) that governs both our platform and our internal company operations. The program is built on the SSAE-18 SOC 2 Trust Services Criteria and the COBIT 5 Framework, and is reviewed continuously against evolving security and compliance requirements.

We have completed multiple SOC 2 Type II audits with independent auditor Kirkpatrick Price. The latest report is available to customers and qualified prospects under NDA.

Security Commitments

Files.com acts as an extension of your security team. Every feature, system, and workflow is designed to keep your data safe without slowing your business down. The platform has operated for over 15 years with zero breaches.

Customers recommend Files.com to boards, regulators, and auditors because we treat every deployment as if our own reputation is on the line.

Four principles guide the program:

Defense in Depth. Multiple layers of infrastructure, application, and personnel safeguards.
Zero Trust Everywhere. Every connection is verified; access is always least-privilege.
Shared Success. Security is a board-level KPI, reviewed weekly at the executive level.
Transparency. Audit reports, pen-test summaries, and policies are available under NDA.

Core Objectives

The InfoSec Program supports:

Business objectives and operational integrity
Security requirements, including identity and access management (IAM), encryption, and continuous monitoring
Regulatory and compliance obligations across multiple jurisdictions

Governance and Oversight

The program is reviewed by the board and as part of our annual SOC 2 audit cycle. Security metrics are tracked and reviewed weekly, including vulnerability mean time to remediate (MTTR), patch latency, and pen-test closure rates. Input from the Customer Advisory Board shapes roadmap priorities.

A dedicated Security Team, led by Chief Information Security Officer Sean E. Smith (HCISPP, CISM, CISSP), oversees the program.

Our CISO and General Counsel attend continuing education programs on a regular basis so that legal, regulatory, and contractual obligations remain current.

Roles and Responsibilities

Security roles and responsibilities are defined and assigned across the company.

The Security Team works with stakeholders across engineering, operations, and customer support to maintain program integrity, and participates in all major architectural reviews and project planning efforts.

Internal Security Policies and Documentation

Files.com maintains an extensive library of internal security documentation, including policies, procedures, standards, and guidelines that govern our operations. This documentation is proprietary and not shared externally. It is reviewed annually and audited as part of our SOC 2 compliance process.

Key coverage areas include:

Access and identity management
Asset and inventory control
Business continuity and disaster recovery
Change management
Data classification, retention, and encryption
Incident response and vulnerability management
Risk management and third-party oversight

Documents are updated immediately when changes are required, and the updates are communicated internally as part of our governance cycle.

Training

All employees and contractors complete mandatory onboarding training covering:

The Information Security Program
Acceptable Use Policy
Work From Home Policy
Privacy and Data Protection
Data Breach
Social Engineering

Annual refresher training is required for all staff, and role-specific security training is provided as needed.

Asset Inventory Review

We conduct a quarterly asset inventory review as part of our Risk Management Program, covering both software and hardware asset listings.

Customer Access to Security Information

All compliance documentation Files.com makes available to customers is published in the Files.com Trust Center. Our public SOC 2 Type II Framework page covers the scope of the SOC 2 Type II audit, our audit history, and the current and upcoming report dates. The Accessing the Report section at the bottom of that page explains how to obtain the report through the Files.com Trust Center.