Regulatory & Industry Requirements
Your organization's obligations depend on its activities, the information it handles, the people and organizations it serves, and the jurisdictions and contracts governing that work. Several requirements can apply to one file-exchange process. For example, a healthcare organization may need to address both protected health information and payment-card data, while an education institution may have student-privacy and accessibility obligations.
Laws and regulations establish obligations for organizations and activities within their scope. Industry standards, agency policies, and contracts can impose additional requirements. Establish which requirements govern your intended use, then evaluate Files.com's capabilities, agreements, and configuration against them.Audits & Assurance explains the independent examinations, certifications, and assessment evidence available to support that evaluation.
Relevant Requirements and Files.com's Position
Start with the information and work involved. The detailed explanations retain the conditions, responsibilities, and evidence relevant to each subject.
| Requirement | Relevant when | Files.com's position |
|---|---|---|
| HIPAA | A Covered Entity or Business Associate uses the service to handle protected health information. | Support requires an Enterprise plan, an executed BAA, and the required security configuration. |
| GDPR | Personal-data processing falls within GDPR's territorial and activity scope. | Data Processor responsibilities supported by a DPA, transfer safeguards, and customer controls. |
| PIPEDA | Canadian commercial activities involve personal information, including relevant cross-border processing. | Configurable safeguards and processing agreements support the customer's accountability; location and processing require separate review. |
| FERPA | An education institution or its service provider handles education records protected by FERPA. | Access controls, activity records, and data-management tools support the institution's authorized use and disclosure process. |
| 21 CFR Part 11 | Electronic records or signatures are used to satisfy applicable FDA recordkeeping requirements. | Platform controls and supplier evidence support customer validation of the configured system and process. |
| PCI DSS | A workflow handles cardholder data or can affect the cardholder data environment. | Level 2 service-provider compliance covers Files.com's billing and customer cardholder-data storage; customers retain their own PCI responsibilities. |
| DORA | An in-scope financial entity evaluates an ICT service arrangement. | Operational controls and a DORA Addendum are available to qualified customers. |
| Accessibility | People need accessible technology, or procurement and legal requirements specify accessibility criteria. | The logged-in web application conforms to WCAG 2.1 Level AA, supported by an annual independent assessment and a VPAT. |
| ITAR | A workflow involves controlled defense articles, services, or technical data. | Native Storage is not ITAR-compliant. Carefully configured customer-controlled storage workflows require review of every data path and recipient. |
| CGR | An organization examines, possesses, or transfers controlled goods or technology in Canada. | Canadian storage and customer-controlled storage are available; access, routing, processing, and records require a complete workflow review. |
Privacy oversight and ICO registration are covered with our customer-data handling practices.
NDAA Section 889
Section 889 requirements matter when federal procurement or a contract requires restrictions on covered telecommunications and video-surveillance equipment or services. The Federal Acquisition Regulation describes the covered equipment, services, prohibitions, and contract requirements.
Files.com is compliant with Section 889 and does not rely on restricted vendors or hardware. If your procurement process requires a supplier representation, contact your Account Executive or Customer Support with the specific requirement.
CJIS
The Criminal Justice Information Services (CJIS) Security Policy is relevant when an agency or service provider handles criminal justice information subject to that policy. Identify the information and the responsible agency's requirements when evaluating a proposed workflow.
Files.com does not meet all requirements of the CJIS Security Policy and is not recommended for environments subject to these requirements. Other Files.com audit reports or certifications do not establish suitability for a CJIS-governed deployment.
COPPA
The Children's Online Privacy Protection Act (COPPA) concerns operators of online services directed to children under 13 and certain other services that knowingly collect personal information from children under 13. The Federal Trade Commission's applicability guidance explains the relevant circumstances. An adult's exchange of records about a child and a service collecting information directly from children present different questions.
Files.com does not offer COPPA-specific functionality and is not intended for use in services directed at children. For institutional handling of student education records, also review FERPA; the institution must establish the obligations applicable to its actual workflow.
NIS2
NIS2 is an EU directive establishing cybersecurity risk-management, incident-reporting, and oversight requirements for covered organizations. Applicability depends on the entity, sector, size, jurisdiction, and national implementing law. The European Commission's NIS2 guidance explains the covered sectors and jurisdictional rules.
A customer subject to NIS2 may need to evaluate Files.com as part of its supplier and service-dependency review. Relevant evidence includes our SOC 2 examination, operational resilience and incident-response practices, and vendor oversight. Evaluate those practices alongside your service arrangement, the information exchanged, and your own reporting and continuity processes.