Cumberland Farms Retired Its FTP Server Fleet and Centralized File-Transfer Security on Files.com

Cumberland Farms, the convenience and fuel retailer formerly operating as EG America, runs more than 1,700 stores across the United States.

An operation that size does business with a long roster of counterparties, and much of that business moves as files. Suppliers send order files for the stores they stock. Finance systems feed outside banks and vendors. Tobacco tax filings go to state agencies. Configuration data has to reach the stores themselves. Those flows cross company boundaries, and many have to run without anyone watching them.

By consolidating them on Files.com, Cumberland Farms retired its server fleet, centralized its controls, and supported a growing account base without adding transfer infrastructure.

A Fleet of FTP Servers, Each Carrying a Slice of the Same Job

That exchange ran on FTP servers Cumberland Farms hosted itself. It was not one server but several, each supporting a portion of the same multi-party requirement, each with its own accounts to manage and its own access to control. Security analyst Julien Croy described the setup as an in-house solution that "doesn't scale well and is limited in management options."

The cost landed in two places. Connecting a new vendor meant provisioning space on a server, so the integration estate could only grow by growing the sprawl. And the security team carried a standing requirements list: IP access control at the user and site level, account expiry, logging, MFA, encryption, usage reporting. Nothing on it was exotic. It was a description of what the scattered servers were not doing, because a control has to apply everywhere to count as a control, and there was no one place to apply it.

The servers could not simply be taken down, either. The exchange was load-bearing: a national beverage supplier dropped order files that automated jobs collected for processing, finance feeds moved to outside banks, and tax submissions went to state regulators. Every server had live counterparties pointed at it. As integrations multiplied, a model where scaling meant standing up another server stopped being survivable.

What Cumberland Farms needed was a single working space where multiple sources, internal and external, could place and pick up files. It had to speak the SFTP its partners already used, scope each vendor to its own space, run automated accounts alongside human ones, and enforce the security list centrally instead of server by server. Cumberland Farms selected Files.com to be that working space.

One Files.com Site, with Vendor Space Scoped by IP

Files.com became the single exchange point every counterparty connects to. The consolidation was not a big-bang cutover: vendor and system endpoints were repointed to the one Files.com site as integrations grew, until the platform carried everything the in-house servers used to.

The vendor pattern is the heart of it. Each trading partner gets a defined SFTP space on the site, restricted to that partner's IP addresses, so no counterparty can reach another's files. The site itself runs on dedicated static IPs under Cumberland Farms' own domain, which gives a partner a fixed address to allowlist and a name they recognize when they connect. Bringing on a counterparty became an account and a folder rather than a piece of infrastructure.

Most of the accounts on the site belong to systems, not people. Service accounts authenticate with SSH keys and run scripted transfers, while staff accounts sit alongside them for the people who need to look.

The Next Counterparty Is an Account, Not a Server

With the endpoints repointed, Cumberland Farms replaced several self-hosted FTP servers with one managed exchange point. The immediate change was the retirement of the servers. The larger one was the shape of everything that came after.

• Every vendor, bank, regulatory, and internal file flow moves through a single Files.com site, and the in-house FTP servers it replaced are gone.
• Onboarding a vendor no longer means provisioning a server. A new partner gets scoped SFTP space against a fixed IP, on a platform where the security requirements are already met.
• The requirements list the fragmented estate could never close was cleared in one place, with nothing outstanding.
• The platform absorbed the growth that broke the old model: the account base expanded without another FTP server.

Security Started with Consolidation

Today, each new supplier, bank feed, or regulatory filing joins the same managed exchange rather than becoming another infrastructure project.

That order of operations is the lesson worth carrying away. The security list was never going to close across a scatter of self-hosted servers, because a control that covers part of an estate is not a control. Consolidating every flow onto one Files.com site was not a cleanup that happened before the security work. It was the thing that made the security work possible.