Lippert Kept OneDrive—and Replaced Citrix ShareFile With Files.com for Sensitive Sharing

Lippert supplies engineered components to OEMs across the recreational vehicle, marine, transportation, and building products industries. The operating business of LCI Industries, it has approximately 11,700 team members and a global, multi-site footprint, with extensive dealings with OEMs, vendors, and other outside parties.

A business shaped like that hands files to outside parties constantly. Contracts and legal documents go to vendors and outside counsel, engineering material goes to OEM customers, and working documents move between partners on two continents. Internally, day-to-day documents live in OneDrive. The problem started where those two facts met: when the file being handed to an outsider was sensitive.

Lippert’s answer was to draw a boundary rather than replace its collaboration suite: it kept OneDrive for internal collaboration, retired Citrix ShareFile, and made Files.com the governed channel for sensitive external sharing.

Legal Documents Were Leaving Through a Tool InfoSec Ruled Out

The files Lippert most needed to control were leaving with the least control on them. Sensitive material bound for third parties, legal documents above all, went out from OneDrive, the same general-purpose store that holds everyone’s everyday work. Lippert’s InfoSec team looked at that class of file and judged OneDrive unsuitable for the job. At the same time, a separate population of users did its external sharing through Citrix ShareFile, so external sharing ran on two tools with two different governance postures. Nobody could point to one approved way to hand a sensitive file to a customer, a vendor, or a lawyer, and with operations across Europe, some of what moved carried GDPR obligations. The diagnosis was plain: sensitive external sharing had no governed front door.

The Collaboration Suite Could Not Go, and ShareFile Habits Had to Move

The obvious fix was unavailable. OneDrive is the legitimate internal document store across Lippert’s approximately 11,700-person workforce, and it does that job well. Shutting it down to control one class of traffic was never on the table. Whatever Lippert did had to carve external sharing of sensitive files out of OneDrive specifically, while everyday internal collaboration went on untouched.

ShareFile set the second constraint. Its users had years of habits built into the tool: address books of repeat recipients, and live collaboration with outside parties on shared documents. A replacement that could not absorb those workflows would not retire ShareFile. It would just add a third tool.

So the requirement was a dedicated external-sharing channel that InfoSec could stand behind: links with expiration, passwords, and recipient control, the company’s own sign-in in front of it, a record of every share, and enough ease of use that people would take the approved path instead of routing around it. Lippert’s InfoSec team settled the question by mandate. OneDrive was banned for sensitive files, and Files.com became the tool of choice for sensitive data.

A Governed Link on Lippert’s Own Domain, With a Reason Attached to Every One

Files.com became the front door for handing files to outside parties, sitting alongside OneDrive rather than replacing it. When a sensitive file needs to leave the company, it moves onto Files.com and goes out as a Share Link on Lippert’s own domain, carrying the controls the platform enforces: expiration, passwords, and recipient restrictions, with every access landing in the audit record.

Lippert added a discipline of its own on top. Every Share Link a user creates must carry an internal note recording what the link is for—a requirement Files.com built into the platform after Lippert asked for it. A review of outstanding links therefore reads as a list of reasons rather than a list of mysteries: who shared what, with whom, and why.

Access follows the same identity model as the rest of Lippert’s estate. Internal users sign in through Okta with two-factor authentication, and folder access is granted through groups, so what a person can reach and share is decided by the team they belong to.

Moving ShareFile’s Users Without Losing Their Workflows

The consolidation came in 2024. Rather than run two sharing tools side by side indefinitely, Lippert decommissioned Citrix ShareFile and moved its users onto Files.com. The Files.com onboarding team ran a working session with the transferring users to map ShareFile-era workflows onto the platform, and the two workflows those users most depended on both landed. Managed recipient lists took the place of ShareFile address books, so a repeat distribution goes to the same set of contacts without rebuilding the list each time. And live collaboration survived the move: an outside party can open and edit a shared spreadsheet through the Share Link itself, with no Files.com account, a capability Files.com shipped after the migration surfaced the need.

One Approved Way to Hand a Sensitive File to an Outside Party

With ShareFile retired and the mandate in force, Lippert replaced two external-sharing tools with different governance postures with a single channel it can fully account for. The change shows up as risk removed and overhead removed:

• Sensitive files no longer leave through a channel the security team ruled out. Every external share of that class runs through the mandated platform, behind Okta sign-in, on a link that expires and can be revoked.
• Citrix ShareFile is gone from the estate: one platform to govern, one policy to enforce, and one audit trail to consult instead of two.
• Every outstanding Share Link carries a documented purpose, so reviewing external access is a lookup rather than an investigation.
• OneDrive kept its job. Day-to-day documents across Lippert’s approximately 11,700-person workforce never moved, because the fix carved out one class of traffic instead of forcing a new home for everything.

Use has kept spreading since. By December 2024, Files.com had 78 users, up from 29 in August 2023. As more teams route their external sharing through the platform, they can adopt an established pattern—a folder, a group, and a link—rather than design another sharing process. InfoSec has already approved it.

Governing the Traffic Instead of Replacing the Toolset

Drawing that line, and putting a mandated platform on the outside of it, is what turned external sharing at Lippert from a habit into a policy.