CIIS Ends Manual Paychex-to-Axiom Handoffs with the Files.com Agent

The California Institute of Integral Studies (CIIS) is a private, nonprofit university in San Francisco offering programs in psychology, counseling, integral health, and the humanities.

Behind that academic work sits the administrative estate every university runs: payroll, finance, budgeting. At CIIS, that estate is split across the firewall. Payroll data comes from Paychex, a cloud provider. Labor-expense planning and budgeting run on Axiom, a forecasting system on a server inside the campus network. Every payroll cycle, sensitive compensation data has to travel from one to the other: from a cloud service to a machine no cloud service can reach on its own.

Payroll Data Carried by Hand Across the Firewall

For years, a person made that trip. Payroll data was moved into Axiom by hand, cycle after cycle. The data in question, what everyone at the university is paid, is about as sensitive as a file gets, and the workflow it feeds is not optional. Axiom is where CIIS plans and budgets its labor expenses, so the finance calendar depended on someone performing that manual step correctly every time.

The step persisted because every conventional fix was bigger than the problem. Axiom sits behind the campus firewall, where external SFTP cannot deliver. The standard ways to open that path are an inbound firewall exception, a VPN, or a custom integration, and each of those is an infrastructure project out of proportion to one recurring file. So the person stayed in the loop.

What the fix had to do was specific: collect payroll data from Paychex as it arrives, deliver it onto the Axiom server inside the network, keep the whole path encrypted and logged, and do all of it without exposing that server to the internet or putting a person back in the middle. Securing its sensitive payroll transfers was one of the requirements CIIS carried into its selection of Files.com, and the Files.com Agent is the piece that carries the path through the firewall.

An Agent Installed From the Documentation, Running the Same Day

In May 2024, Corinne Ewan, Application Support Engineer at CIIS, installed the Files.com Agent on the on-premise server herself, working from the documentation.

“Setting up the agent was crazy simple!”

The Agent runs as a system service, so it starts with the server and depends on no one being logged in. It connects outward to Files.com over an encrypted connection, which means the server inside the campus network is never exposed to the internet and no inbound firewall rule changes. When payroll data from Paychex lands in Files.com, a Files.com Automation forwards it through the Agent onto the Axiom server, and the transfer is written to the audit log like every other transfer on the site. The automations were running the same day the Agent was installed.

What Changed for the Payroll Cycle

With the Agent in production, CIIS replaced a manual handoff of sensitive compensation data with an automated path that ends inside its own network.

• Payroll data from Paychex reaches Axiom with no one touching it. The manual step in a recurring finance workflow is gone.
• Compensation data travels over encrypted, logged channels end to end, instead of by hand at the most sensitive point.
• The campus network stayed closed. The Agent’s outbound-only connection meant no inbound firewall exception and nothing newly exposed.
• Reaching on-premise stopped being a project. Standing up the crossing took one engineer a single day of self-service work, and the Axiom server is now an ordinary destination for Files.com Automations, reachable the same way any cloud endpoint is.

One Estate on Both Sides of the Firewall

Today, a payroll cycle at CIIS starts in Paychex and ends inside Axiom with nobody in between.