How a Consumer Goods Distributor Unified SFTP Security Across Five Autonomous IT Teams With Files.com

A multinational consumer goods distributor imports, markets, and distributes branded products for international manufacturers through regional operating units in five countries.

A distribution business of that shape runs on data exchange. Suppliers push product and sales data, orders and inventory flow through SAP, and partner files feed the Power BI dashboards the business is steered by. Because each of the five business units operates in its own market, each runs its own IT team and its own help desk, under a global infrastructure and security function. That structure reached all the way down to file transfer: every country ran its own on-premise SFTP/FTP server.

Five Servers, Five Firewalls, and Every Control Set Five Times

For the global security team, the estate was five separate installations to govern. Every new partner meant an account created by hand on that country's server. Every control existed in five copies: the group is required to block access from countries where it is not permitted to have clients, and that geo-blocking had to be operated separately, firewall by firewall. Sending a file too large for email meant local IT creating a temporary user on the regional server and sending the recipient a password-protected link. And all five servers were self-managed infrastructure that somebody had to keep patched.

The estate had survived because the obvious fix looked worse. The group's countries are genuinely separate operations, and consolidating onto one centrally run server would have turned global IT into the help desk for five markets' worth of users, partners, and folder changes. The group wanted one security posture and one audit trail spanning all five countries, without taking user and folder administration away from the regional teams. As unattended supplier and customer automation became the dominant file workload, the question of which user touched which file, when, had to be answerable for every region from one place.

The Replacement Had to Keep Local IT in Charge

What the new platform had to do was written by the structure of the company. It had to be SaaS, with vendor-managed updates and data hosted in Western Europe. It had to carry one global security posture: geo-blocking of sanctioned countries, plain FTP restricted to named partner IPs, a full audit trail, and retention schedules that differ by business unit. And it had to preserve five autonomous administrative domains, because day-to-day user and folder administration was staying with each country's IT team, without handing every regional team administrative rights over the whole platform.

The group selected Files.com to be that platform: one site holding five separately administered regions under a single security posture.

One Site, Five Delegated Regions

Identity came first. The group connected the site to Microsoft Entra ID for SAML single sign-on, with SCIM provisioning and Active Directory group sync, so accounts follow the directory instead of being built by hand. Using Files.com's group-admin roles and synchronized AD groups, the security team gave each regional IT team control over the users and folders under its own country branch without granting site-wide administrative rights. Each country's IT runs its own region, and nobody outside the global team holds site-admin rights.

Each business unit got its own country-scoped folder tree, with folders per customer, supplier, and sister company underneath it, and Files.com retention policies set per unit, so each country's schedule coexists with the others on the same site. The temporary-account pattern for large files went away too: files far too large for email now move as expiring, password-protected Files.com share links, inside the same audit trail as everything else.

A Global Security Posture, Set Once

The controls that used to live in five firewalls now live in one place. Files.com geo-blocking shuts out the countries the group is not permitted to serve, across every region and every protocol at once.

Plain FTP, which one legacy partner connection still requires, is restricted to that partner's named IP addresses; everything else runs over SFTP or HTTPS. The site runs on the group's own branded domain with dedicated IP addresses, so partners whitelist just two addresses. Data is stored in Western Europe, and every login, connection, and file action lands in the audit log, queryable per user and exportable through the Files.com API.

A Process Migration, Region by Region

The group deliberately scoped the move as a process migration: workflows moved to Files.com while legacy data stayed where it was, so no cutover depended on hauling years of files into the cloud. The rollout ran in two phases per country through 2025, automated server-to-server accounts first and human users after, with each regional IT team owning its own deployment and the legacy server running in parallel until the region was verified.

Only active accounts were carried over. As each region was verified, its on-premise server was shut down.

Every Process Moved, Every Server Shut Down

Since the cutover, the group has replaced five locally patched, locally administered servers with one governed platform and completed the rollout, with every remaining user moved.

• Every file-transfer process across all five countries, plus external counterparties in the Americas, runs through one Files.com site, and all five on-premise servers are decommissioned. There is no server left to patch.
• Global IT can answer who touched which file, and when: per-user connection and file-access history is queryable across all five regions and exportable through the API, and the team runs monthly upload-count reporting across the group.
• The security posture is enforced everywhere from one place. Geo-blocking, protocol restriction, IP whitelisting, and per-business-unit retention apply to every region without five firewalls to keep in step.
• Roughly half of all accounts on the site are system accounts running unattended server-to-server SFTP with suppliers and customers, so the automated data pipelines feeding SAP and Power BI now run inside the same logged, governed platform as everything else.

The compounding change is what growth costs now. Onboarding a new partner in any country is a folder and a user under that country's branch, created by the regional team that owns the relationship: no ticket to global IT, no account built by hand on a server, no new infrastructure anywhere. New users arrive from the directory, and departed ones leave with it.

Consolidated, Not Centralized

The group's structure did not change. Five business units, five IT teams, five help desks, and that was the point. What changed is where the security lives. Before, a question about who was using a country's file server was a question for that country. Now the same question is a lookup on one Files.com site, and the answer covers all five countries. Global IT owns the platform, the posture, and the audit trail; each country's IT still creates its own users and runs its own folders, the way the business is built to operate. The group consolidated five countries' file transfer without centralizing it: the security became global, and the administration stayed local.