Old Republic General Services Uses Files.com Child Sites to Delegate Control Without Giving Up Governance

Old Republic International has been underwriting specialty insurance since 1923. It is a Fortune 500 company whose general insurance business ranks among the nation's 50 largest, and whose title insurance business is the third largest in its industry. It conducts that business through a decentralized collection of specialist operating companies.

The structure is deliberate. Old Republic runs a model built on narrow and deep expertise: each operating company is designed to know its market better than anyone else, with decision-making authority placed close to the customer and the risk.

Old Republic General Services (ORGS) is the shared-services organization that holds the corporate side of that together. It provides data processing, accounting, administrative, and professional services to the group's insurers, and some affiliated entities have no employees of their own, running entirely on ORGS staff. In 2024, ORGS stood up its own independent IT department, taking over infrastructure that had previously been run out of another subsidiary. Its mandate was to provide IT, including file transfer, to operating centers across a group of 17 divisions: specialist companies that were designed, on purpose, to have almost nothing in common about how they work.

One IT Team, Divisions With Nothing in Common

The first two divisions that needed file transfer made the problem concrete.

Old Republic Accident & Health, launched in 2023 as the group's newest underwriting subsidiary and the sixth new company Old Republic had started in eight years, writes employer stop-loss coverage for self-funded employers. Its hospital partners send large files carrying HIPAA-regulated patient information, and the new division needed a compliant way to take them in.

Old Republic Insured Automotive Services (ORIAS) has administered GAP plans and vehicle service contracts for automobile dealers since 1974. Its file work looks nothing like a PHI intake: warranty documents exchanged back and forth with automotive customers, on no fixed schedule, with counterparties who connect through a browser rather than an SFTP client.

Serving both from one flat environment would have forced a bad trade. Either division staff get broad administrative credentials over an environment that also holds another company's data, with hospital PHI sitting alongside warranty paperwork, or the small shared-services team operates everything itself: every user account, every folder, every permission change, for every division. Old Republic launches new operating companies regularly. A model where central IT hand-brokers each division's file transfer does not survive division three, let alone seventeen.

And the governance could not loosen to compensate. These are regulated insurers whose intercompany service arrangements appear in state insurance department examination reports. ORGS needed each division to run its own file exchange, and it needed to answer for all of it.

What the Platform Had to Be

Whatever ORGS deployed had to give each division a genuinely separate environment, with its own branding, its own administrators, its own users, and its own compliance posture, so that a HIPAA-covered intake for one division imposed nothing on a division trading warranty files. It had to speak SFTP to hospital systems and hand a browser link to a warranty customer. And it had to stay one platform, with one place where corporate IT holds oversight and a complete record of every file.

ORGS selected Files.com to run the group's file exchange on that model.

A Separate Site for Every Division

On Files.com, ORGS operates one platform that presents each division with its own site.

Accident & Health went first. ORGS created a Files.com child site for the division: a fully separate site under the corporate parent, carrying the division's own branding, users, and administrators. The division piloted the intake with a single hospital partner, then widened it to all 15 hospitals, each delivering PHI-bearing files over SFTP into the division's own site under a HIPAA Business Associate Agreement.

The Files.com Agent can deliver those files to the group's internal storage over an outbound-only connection. Because the hospitals connect to the Files.com endpoint rather than the storage behind it, they can keep using the same connection as ORGS moves its back-end infrastructure from on-premises storage to Azure.

A second child site followed in January 2025 for ORIAS, carrying an entirely different workload: warranty files sent to and received from automotive customers through branded Files.com Share Links, in the browser, with no account or software on the other end.

Each site has its own administrators. A division manages its own users, access, and use cases, and cannot see or reach a sibling division's site, because administrative credentials stop at the site boundary. Corporate IT retains oversight of every site from the parent.

“Now you can be more restrictive with who gets certain administrative credentials.”

ORGS configured the deployment in-house, building the connections, workflows, service accounts, and folder structures with its own team. And every file on every site carries its own audit history: who uploaded it, who moved it, who downloaded it, and when. The group knows who owns a regulated file at all times and where it has been.

What Changed for the Group

With both child sites in production, ORGS replaced the choice between one undifferentiated environment and a hand-operated central service with a standing pattern: each division gets its own governed site. Bringing on the next division is a child site, not a platform project.

The shared-services team no longer stands between a division and its own file transfer. It does not create the division's users, field its access changes, or administer its workloads. It governs them.

File Transfer That Runs the Way the Group Runs

Old Republic built itself as a collection of specialist companies with decision-making placed close to the customer, and today its file transfer works the same way. When Accident & Health takes in a hospital file, or ORIAS sends a warranty document to a customer, the division is operating its own Files.com site, under its own name, run by its own people. The shared-services team that answers for the group's governance can see all of it without operating any of it. ORGS never had to choose between delegating file transfer and controlling it: on Files.com, a small central IT team serves a group of independent companies by handing each one its own site and keeping one set of controls over everything.