Damas Jewellery Avoids Hosting an SFTP Server With Repeatable Encrypted Partner Feeds on Files.com

Damas Jewellery is a jewellery and watch retailer headquartered in Dubai and operating across the Gulf. Its retail business is supported by a marketing and analytics operation, and the specialists who turn that data into decisions are not all inside the company. Some are external processors running their own platforms in other countries. The data has to leave Damas to reach them, and how it leaves is a security decision a high-value retailer cannot get wrong.

A Vendor Sync With Nowhere to Put the Files

In 2022, a vendor data-sync project made the question concrete. Damas would push files out, and the vendor would collect them from an SFTP location. Damas had no such location. There was no partner-exchange infrastructure to point the vendor at.

The default answer was to build one: stand up an SFTP server on the company's own perimeter, open it to the internet, and take on the hardening, the patching, and the standing exposure of a machine that outside systems can reach around the clock. And the decision would not be made once. Every future processor would repeat it, each new partner its own bespoke exposure. For an IT team whose bar for any platform touching this data was security and reliability, an ungoverned handoff to third parties was not an option.

Open to a Machine in Sweden, Closed to Everything Else

The endpoint had to be reachable by partner systems Damas did not control, including an analytics product hosted in Sweden. It also had to be closed to everyone and everything else, down to individual addresses and whole countries.

The controls also had to layer differently by connection type. A machine-to-machine feed would authenticate with an API key and could not present a second factor, so MFA would cover none of the connections that mattered most; where a second factor was impossible, access had to be pinned another way. And the files themselves would sit in folders that outside parties collected from, so they had to be readable by the intended partner and nobody else, even at rest.

The fix, then, had to do four things: provide an SFTP endpoint Damas did not have to build or expose, restrict each partner connection by IP address and by country, encrypt the data per partner at the point of handoff, and enforce two-factor authentication on every human account. Damas selected Files.com as that hosted handoff layer—and as a pattern it could repeat for future processors.

Encrypted Drop Folders Behind a Deny-by-Default Perimeter

Files.com became the endpoint that sits between Damas and its outside processors. Partners collect from the platform, and nothing connects into Damas at all.

On its side, Damas uses API keys and Files.com Automations to push recurring deliveries into the site. The files land in partner-specific drop folders where Files.com applies GPG encryption at the folder level. Outside processors then connect to Files.com over SFTP to collect from their assigned folders, with access constrained by per-partner IP allow-listing and country-level rules that deny by default.

That posture proved itself early: when the Sweden-hosted analytics product first tried to connect, the platform refused it because no country had been opened. Allow-listing Sweden let that one partner through while the rest of the world stayed blocked.

Human access is layered separately. Every human account is created under a mandatory 2FA standard that Damas enforces itself, built on Files.com's own administrative guidance.

From One Analytics Feed to a Standing Partner Pattern

With the feeds in production, Damas replaced what would have been an infrastructure project with a repeatable handoff pattern.

• Recurring partner feeds run machine-to-machine on Files.com, with nobody at Damas moving files by hand. The original delivery began with a single CSV file a day to the analytics provider.
• Damas never built an internet-facing SFTP server. There is no machine of its own to harden, patch, or monitor, and no inbound path into its network for partners to use.
• Data waiting for collection is encrypted per partner, and only allow-listed addresses can reach it. A partner platform in Sweden gets through, and connections from anywhere else do not.
• Onboarding the next processor is a drop folder, an encryption key, and an allow-list entry, not a new exposure decision.

The Handoff Is a Pattern, Not a Project

What began with one scheduled analytics file has since widened to additional partner feeds carrying marketing and analytics data, using the same encrypted, tightly restricted handoff pattern.