Brightline Stopped Standing Up an FTP Server for Every New Client and Retired Fortra’s GoAnywhere With Files.com

Brightline is a behavioral health provider offering therapy, psychiatry, and coaching for children, teens, and their families.

In its early years, Brightline delivered care nationwide as an employer-sponsored benefit. That model made file exchange the first step of every contract. Before any family could be reached, the employer had to send Brightline data about who was eligible and how to contact them. Those eligibility and contact files came out of each employer’s own systems and carried sensitive personal data handled under HIPAA.

An FTP Server for Every Contract Signed

Every employer Brightline signed got its own FTP server. Brightline stood one up at every client launch so the employer had a credentialed place to deliver eligibility and contact files. This was not an occasional request. It was a guaranteed step in every single launch, because eligibility exchange was how the entire business model worked.

The cost landed on both sides of the launch. Onboarding a client was gated on building transfer infrastructure, so the sales pipeline translated directly into infrastructure work. And each server that went up stayed up: one more piece of sensitive-data infrastructure to secure and eventually decommission, multiplying with every contract. A separate platform, GoAnywhere, ran the marketing data workflow alongside.

The practice persisted because each employer genuinely needed its own isolated, credentialed endpoint, and a dedicated server was the obvious way to provide one. Isolation was being bought with infrastructure. As the employer roster grew, that trade got worse. Each launch brought another infrastructure build, and the fleet of servers to look after only grew.

What Brightline needed was the same isolation without the construction. Each employer had to get its own credential and its own walled-off drop point. The endpoint had to speak SFTP for employers that automated their feeds and offer a browser for teams that didn’t. Files arriving GPG-encrypted had to be decrypted without a manual step. And the whole exchange had to run under a HIPAA BAA. Brightline selected Files.com to be that shared exchange layer. That choice would later allow the same layer to carry a different set of connections when Brightline’s business changed.

A Provisioned User Instead of a Provisioned Server

On Files.com, every new employer became a provisioning step on one platform instead of a build. Brightline created a user and an endpoint for each client on its Files.com site, scoped to that client’s own folders. Employers delivered files over SFTP or uploaded through the web interface, on Brightline’s own custom domain either way.

The handling that used to live in per-server setup moved into the platform. Files that arrived GPG-encrypted were decrypted automatically by Files.com on arrival, with no one running a key by hand. Security was configured once and applied to every client’s exchange: a HIPAA BAA covering the site, SAML single sign-on and two-factor authentication for Brightline’s own team, and IP whitelisting enforced site-wide and per user. Files.com also took over the marketing data workflow that had run on GoAnywhere, so employer files and marketing data moved through the same governed layer.

Client Launches Without the Infrastructure Work

With Files.com carrying the exchange, launching a client stopped being an infrastructure project.

“Before, every single client that we launched, we’d have to set up an FTP, and now that’s just not a thing for us.”

• Onboarding the next employer is a credential and a folder on the existing Files.com site, with no transfer infrastructure to build and nothing new to secure.
• The fleet of one-off FTP servers is gone, and with it the standing obligation to patch and decommission each one. Every client exchange runs under one HIPAA BAA-covered platform with one record of activity.
• GoAnywhere is retired. One platform carries what two systems and a fleet of servers used to.

The Exchange Layer Outlived the Business Model

Brightline’s business changed. It moved from a nationwide employer-benefits model to hybrid care built around its own clinics, and the per-client eligibility feeds gave way to a smaller set of targeted vendor data connections. The Files.com site absorbed that change without re-architecture. The counterparties are different; the pattern is the one the platform was already running.

That is the durable difference in how Brightline operates. It solved file exchange once, at the platform level, instead of once per counterparty. The next connection starts on Files.com, not with another server.