AbelsonTaylor Meets Pharma Data-Residency Terms Without Self-Hosting SFTP

AbelsonTaylor is an independent healthcare and pharmaceutical marketing and advertising agency serving regulated brands. Its daily work ran on inbound data: vendors and clients routinely sent files to the agency, putting its compliance obligation exactly where control was hardest—at a public-facing endpoint where outside parties pushed data in.

Its clients wrote data-storage terms into their agreements: the agency’s data had to remain inside the United States, with security and audit requirements including SOC 2 and GDPR attached. AbelsonTaylor selected Files.com to meet those terms through a US-resident, Okta-governed SFTP perimeter rather than infrastructure the agency had to build and defend itself.

US-Only Storage, Written Into Client Contracts

The cost of getting this wrong was not an inefficiency. It was the work itself. A file-exchange path that could not guarantee US residency would put the agency in breach of its clients’ terms, and the VP of IT Operations was explicit that anything short of a guaranteed US storage location was a non-starter for exactly that reason. An agency that cannot answer the residency question cannot take or keep regulated pharma accounts.

The structural problem was who would have to answer it. AbelsonTaylor is a creative business. Meeting these terms on its own would have meant hosting and hardening a public SFTP service, running the account lifecycle for internal and external users, keeping distinct internal workloads separated from each other, and standing behind all of it in every client security review. That is an infrastructure company’s job, and it was a disproportionate burden for an IT team whose purpose was to run an advertising agency.

What the Intake Perimeter Had to Guarantee

The requirements defined the gap. The perimeter had to guarantee storage inside the United States. It had to carry the certifications and posture a client audit expected, including SOC 2 and GDPR. Because clients and vendors would connect to it directly, it had to present under the agency’s own name rather than a third party’s. Its accounts had to be governed by the corporate identity system rather than maintained by hand. And it had to keep separate internal workloads genuinely separate.

Branded SFTP, Pinned to US Data Centers, Governed by Okta

Vendors and clients sent data to AbelsonTaylor over SFTP through a custom domain with a dedicated IP, so the endpoint read as the agency’s own. The site’s storage was pinned to Files.com’s US data centers, satisfying the residency language in the client contracts, while the platform’s SOC 2 and GDPR posture satisfied the audit language alongside it.

Behind the endpoint, accounts followed the agency’s Okta directory. Files.com SCIM provisioning created users and applied their group memberships from Okta, deactivated them when they left the directory, and auto-disabled accounts that went dormant. Per-directory permissions scoped each party to its own area of the site.

The pattern held up beyond its first use. Within roughly six months of the initial deployment, a second department stood up its own SFTP environment for a distinct workload, with strict permission separation maintained between the two.

Two Environments, One Parent Account

With the Files.com endpoint in production, AbelsonTaylor met residency, audit, and directory-governance requirements across two separated environments through the platform where its data landed, rather than infrastructure the agency built and defended itself.

In May 2026, the two environments were brought under a single parent account as Files.com child sites. Files.com performed the consolidation, users retained uninterrupted access, and the permission separation between the environments was preserved.

Compliance as a Property of the Perimeter

None of this was driven by data volume. It was driven by where the data may live and who may touch it, which is the question a regulated client’s contract actually asks. Since moving its intake onto Files.com, AbelsonTaylor answers that question with a property of the platform rather than a project of its own: files from clients and vendors arrive at an endpoint carrying the agency’s name, land in US-pinned storage, and are reachable only by accounts the corporate directory controls.

When a client contract carries the same storage terms, there is nothing new to build. The perimeter already meets them, which lets a creative agency keep taking regulated pharma work without becoming an infrastructure company to hold it.