Lawson Moved Source Atlantic’s Vendor SFTP Off the Seller’s Data Center in Two Weeks—Without Password Resets

Lawson Products has distributed maintenance, repair, and operational products since 1952, selling industrial consumables and parts through a direct field sales force. Lawson is one of the operating companies of Distribution Solutions Group, and much of its growth has come through acquisition, a process the company treats as a deliberate discipline: find well-run businesses that fit, and bring them in.

Every one of those deals hands Lawson’s IT team the same assignment. The acquired company arrives running systems that belong, in whole or in part, to somebody else, and those systems have to be absorbed. When Lawson acquired Source Atlantic, a Canadian MRO distributor with 22 branch locations, that assignment included moving its vendor file exchange off a seller-controlled server Lawson could not access. The replacement also had to keep data in Canada and preserve existing credentials for roughly 54 users Lawson had never administered.

The Vendor Exchange Stayed Behind in the Seller’s Data Center

Source Atlantic’s file exchange with its own vendors ran over SFTP and FTP on a server hosted in its former parent’s data center. Lawson bought the company. The server stayed with the seller. From day one, the acquired business’s daily work with its vendors depended on infrastructure Lawson could not administer, could not monitor, and could not keep. Every day it stayed there extended a dependence on an organization Lawson was actively separating from.

Getting off it had to happen at arm’s length. There was no network connection between the two companies, and the former parent was not going to grant Lawson permissions inside its FTP environment. What Lawson would get was an extract: the seller dumped the content and permission model out of the legacy system and handed it over as files, to be made sense of on the other side.

There was a second constraint. Source Atlantic counts the Canadian government among its customers, which places its data under Canadian sovereignty rules. That ruled out the simplest answer, folding the subsidiary into the US parent’s existing environment, because the requirement was storage in Canada.

So the replacement had a clear specification before it had a name. It had to be a separate SFTP endpoint under Lawson’s control, with its own storage region. It had to be rebuilt entirely from the seller’s export, since nobody was getting access to the source system. And it had to carry over credentials for a user base Lawson had never administered, so that external vendors were not forced through password resets in the middle of an ownership change.

A Child Site, Provisioned in Minutes and Locked to Canada

Lawson did not need a new platform. It already ran the group’s file exchange on Files.com, moving data between the operating companies under Distribution Solutions Group and taking file drops from vendors.

Lawson made Files.com the acquired company’s SFTP server as well, by standing up a Files.com Child Site: a fully separate site nested under the parent site it already ran. Provisioning it took roughly two minutes.

The child site gave Source Atlantic its own boundary without giving up central control. It carries its own users, folders, and permissions, apart from the parent’s, while Lawson’s administrators run it from the parent site. A region lock pins its storage to Canada, so the subsidiary’s data stays resident in Canada and the sovereignty rules its government business carries are satisfied by configuration rather than by construction.

The rebuild worked entirely from the seller’s extract. Lawson dissected the export, reverse-engineered the legacy permission model, and recreated the accounts and folder structures on the child site, using the export as the reference map. For credentials, Source Atlantic supplied its existing usernames along with their SHA-256 password hashes. Files.com imports password hashes directly, so Lawson loaded them as they were, tested against individual accounts first and then rolled out in bulk. When vendors connected to the new endpoint, the passwords they had always used worked.

Lawson moved roughly 54 users off the legacy system inside a two-week working window.

Off the Seller’s Infrastructure in Two Weeks, Without a Password Reset

With the child site live, Source Atlantic’s vendor exchange runs on infrastructure Lawson controls. The former parent’s server carries none of it.

• A 22-branch acquired business came off the seller’s data center inside two weeks, ending Lawson’s dependence on the organization it was separating from.
• Roughly 54 migrated users kept their existing usernames and passwords.
• Canadian data residency holds by design: the region lock keeps the subsidiary’s files in Canada while Lawson administers the site centrally.
• Lawson hosts nothing. There is no replacement server to patch and no data center footprint inherited from the deal.

What Absorbing an Acquisition Looks Like Now

The migration gave Lawson a repeatable playbook for the next acquisition. A Child Site takes roughly two minutes to provision and can maintain its own users, folders, permissions, security policy, and storage region under the same parent. Absorbing an acquired business’s file exchange is now a pattern Lawson has already run once: stand up a site, lock the region, rebuild from the export, import the credentials.

Cutting the acquisition loose from its seller’s infrastructure never required reaching that infrastructure at all: an export, a region-locked child site, and two weeks were enough.