Connexure Made Its Sensitive-Data Policy Enforceable With Files.com—Without Building in Azure

Connexure builds the software the medical stop-loss market runs on. The approximately 100-person company develops underwriting, quoting, and claims administration platforms and serves some of the largest health payers in the United States.

Stop-loss is insurance about health claims, which means everything inside these systems concerns someone’s medical care. The products carry large volumes of PHI and PII, and so does the daily work of the people who build and support them: database extracts pulled for debugging, spreadsheets of claims data, screenshots of client records attached to a question for a colleague.

“What we’re trying to do is give a place for our internal employees to put PHI and PII.”

That was the problem in one sentence. The people who work on the software have to put regulated data somewhere while they work, and for most of the company’s history, there was no sanctioned somewhere.

A sensitive-data policy becomes enforceable on the day it can name a destination as easy as the tools it bans.

A Sensitive-Data Policy With Nowhere to Point

Sensitive data went wherever convenience took it. Employees emailed PHI to each other. They pasted screenshots of client records into Microsoft Teams. They saved extracts to their own laptops and parked working files in OneDrive and SharePoint. Regulated data was scattered across email, chat, cloud drives, and laptops, with no audit trail behind any of it.

Blount was writing the sensitive-data policy that would prohibit all of it, and he could not publish it. A policy banning email, Teams, SharePoint, OneDrive, and local storage bans every place employees actually kept their files, and it named no place they could keep them instead. Telling people to stop was the easy half. Telling them where to go was the half he didn’t have.

The pressure to close that gap was not only internal. Connexure’s clients are large payers, and large payers audit their vendors: security and risk questionnaires arrive asking in detail how data like theirs is handled. Private-equity ownership had brought its own mandate to put guardrails around how the company operates. The distance between having a policy and being able to enforce one was exactly what both would probe.

Why Connexure Didn’t Build It in Azure

The consensus inside the company was to build the destination themselves: an Azure blob store, a file share per user, VNET integrations, and hand-built guardrails around all of it. Blount could have built that. He didn’t want to, for reasons that had nothing to do with feasibility.

The first was separation. The store would live inside the same Azure environment that runs Connexure’s products, which is the environment the sensitive tier was supposed to be isolated from. The second was maintenance. Every guardrail would be his team’s to build and keep current indefinitely, at a thirty-year-old company whose infrastructure had never grown up alongside the business. A hand-rolled compliance store is a permanent engineering commitment disguised as a storage bucket. The third, and the decisive one, was adoption. A destination harder to use than email loses to email. People were putting PHI in Teams because Teams was where the work happened, and whatever the policy named had to cost them nothing to switch to.

So the requirement took shape before any product entered the picture: a compliant platform hosted entirely outside Connexure’s own environment, carrying HIPAA with a BAA and SOC 2 attestation a payer’s auditors would accept, giving every employee a space of their own without anyone provisioning it by hand, logging file activity, and showing up on a laptop as nothing more exotic than a drive.

Connexure selected Files.com to be that destination.

A Compliant Folder for Every Employee, Surfaced as Just Another Drive

What Connexure built is simple to describe: Files.com became the sanctioned home for regulated data, wired into the identity the company already manages and presented through a drive letter.

Identity came first. Connexure connected Microsoft Entra ID to Files.com over SAML for sign-in and turned on SCIM provisioning, so accounts follow the directory. The entire company was provisioned in a single automated pass, and membership stays synchronized from Entra ID. Files.com Data Governance rules create a personal folder for each user automatically from group membership, so a new hire gets a compliant space the moment the directory knows about them, and a departure deactivated in Entra ID loses access, with nobody touching a file account by hand in either direction.

Then the surface. The Files.com Desktop app was pushed to every company laptop through Intune, and each person’s folder appears as a mapped drive. That was deliberate. Blount wanted employees treating the platform like an old-school file share: save PHI to the drive, without needing to know or care what sits behind it. There is no portal to learn and no new habit to form. The banned behavior and the sanctioned one differ by one drive letter.

Underneath the drive sit the controls the old channels never had. Group permissions scope what each team can write, read, or merely list. File extension rules block what shouldn’t land there at all. Every upload and download is written to the Files.com audit log, and the platform carries the posture the whole design existed for: HIPAA with a signed BAA, and SOC 2.

The boundary was drawn deliberately. Files.com took the regulated tier only. The client folder structure that had held sensitive material on SharePoint moved over, while SharePoint and OneDrive stayed in place for non-regulated content and Teams remained where day-to-day collaboration happens, minus the sensitive files.

The Policy Shipped With a Destination

Files.com went live across the company, and with it the sensitive-data policy went from unpublishable to enforceable.

• The policy has an answer written into it. Employees barred from email, Teams, OneDrive, SharePoint, and their own disks have a named destination, and adopting it costs them nothing, because it is a drive already on their laptop.
• Regulated data sits behind one HIPAA platform instead of five ungoverned channels. When a payer’s security questionnaire asks where PHI lives and who has touched it, the answer is a BAA-backed platform with an audit trail rather than an explanation.
• Provisioning is nobody’s job. Every hire gets a compliant folder from the directory automatically, and every departure loses access when their account is deactivated, so the compliant tier scales with the company without a single hand-created account.
• The Azure build never happened. Blount’s team runs a directory integration and a policy, not a hand-built storage estate with homemade guardrails, and the sensitive tier sits outside the environment that runs Connexure’s products.

As Easy as the Tools It Bans

Before, a Connexure employee holding a client’s PHI faced a quiet choice between convenience and compliance, and convenience won every time, because the compliant option did not exist. Now they are the same choice. An engineer working through a claims extract saves it to a drive, exactly as they always have, and Files.com handles everything they never see: the separate environment, the permissions, the log entry.

That is the portable lesson in Connexure’s story. The destination did not have to be built, hosted, and guarded in-house to be under the company’s control. Connexure wrote Files.com into the policy, and the policy stuck.