An Industrial Distributor Moved an Acquisition’s Vendor SFTP Off the Seller’s Data Center in Two Weeks—Without Password Resets

A North American industrial distributor sells maintenance, repair, and operational products through a direct field sales force. It is one of several operating companies under a parent group, and much of its growth has come through acquisition, a process the company treats as a deliberate discipline: find well-run businesses that fit, and bring them in.

Every one of those deals hands the distributor’s IT team the same assignment. The acquired company arrives running systems that belong, in whole or in part, to somebody else, and those systems have to be absorbed. When the distributor acquired a Canadian distributor with a network of branches, that assignment included moving its vendor file exchange off a seller-controlled server the distributor could not access. The replacement also had to keep data in Canada and preserve existing credentials for dozens of users the distributor had never administered.

The Vendor Exchange Stayed Behind in the Seller’s Data Center

The acquired company’s file exchange with its own vendors ran over SFTP and FTP on a server hosted in its former parent’s data center. The distributor bought the company. The server stayed with the seller. From day one, the acquired business’s daily work with its vendors depended on infrastructure the distributor could not administer, could not monitor, and could not keep. Every day it stayed there extended a dependence on an organization the distributor was actively separating from.

Getting off it had to happen at arm’s length. There was no network connection between the two companies, and the former parent was not going to grant the distributor permissions inside its FTP environment. What the distributor would get was an extract: the seller dumped the content and permission model out of the legacy system and handed it over as files, to be made sense of on the other side.

There was a second constraint. The acquired company counts the Canadian government among its customers, which places its data under Canadian sovereignty rules. That ruled out the simplest answer, folding the subsidiary into the US parent’s existing environment, because the requirement was storage in Canada.

So the replacement had a clear specification before it had a name. It had to be a separate SFTP endpoint under the distributor’s control, with its own storage region. It had to be rebuilt entirely from the seller’s export, since nobody was getting access to the source system. And it had to carry over credentials for a user base the distributor had never administered, so that external vendors were not forced through password resets in the middle of an ownership change.

A Child Site, Provisioned in Minutes and Locked to Canada

The distributor did not need a new platform. It already ran the group’s file exchange on Files.com, moving data between the parent group’s operating companies and taking file drops from vendors.

The distributor made Files.com the acquired company’s SFTP server as well, by standing up a Files.com Child Site: a fully separate site nested under the parent site it already ran. Provisioning it took roughly two minutes.

The child site gave the acquired company its own boundary without giving up central control. It carries its own users, folders, and permissions, apart from the parent’s, while the distributor’s administrators run it from the parent site. A region lock pins its storage to Canada, so the subsidiary’s data stays resident in Canada and the sovereignty rules its government business carries are satisfied by configuration rather than by construction.

The rebuild worked entirely from the seller’s extract. The distributor dissected the export, reverse-engineered the legacy permission model, and recreated the accounts and folder structures on the child site, using the export as the reference map. For credentials, the acquired company supplied its existing usernames along with their SHA-256 password hashes. Files.com imports password hashes directly, so the distributor loaded them as they were, tested against individual accounts first and then rolled out in bulk. When vendors connected to the new endpoint, the passwords they had always used worked.

The distributor moved the user base off the legacy system inside a two-week working window.

Off the Seller’s Infrastructure in Two Weeks, Without a Password Reset

With the child site live, the acquired company’s vendor exchange runs on infrastructure the distributor controls. The former parent’s server carries none of it.

• The acquired business came off the seller’s data center inside two weeks, ending the distributor’s dependence on the organization it was separating from.
• Migrated users kept their existing usernames and passwords.
• Canadian data residency holds by design: the region lock keeps the subsidiary’s files in Canada while the distributor administers the site centrally.
• The distributor hosts nothing. There is no replacement server to patch and no data center footprint inherited from the deal.

What Absorbing an Acquisition Looks Like Now

The migration gave the distributor a repeatable playbook for the next acquisition. A Child Site takes roughly two minutes to provision and can maintain its own users, folders, permissions, security policy, and storage region under the same parent. Absorbing an acquired business’s file exchange is now a pattern the distributor has already run once: stand up a site, lock the region, rebuild from the export, import the credentials.

Cutting the acquisition loose from its seller’s infrastructure never required reaching that infrastructure at all: an export, a region-locked child site, and two weeks were enough.