Orion Pharma Moves Research Exchange From Self-Hosted SFTP to GxP-Validated Files.com in Five Weeks

Orion Pharma is a Finnish pharmaceutical company that develops, manufactures and markets human and veterinary medicines and the active ingredients behind them. Its products are sold in over a hundred countries, and its pharmaceutical R&D concentrates on oncology and pain. About 4,000 people work there.

That research engine runs on data that comes from outside the company. Sequencing and bioimaging datasets arrive from contract research organizations, universities and imaging labs, with single files reaching 150 gigabytes and whole datasets up to two terabytes. Final statistical reports and SAS analysis outputs travel the other way, to the FDA and the EMA. Nearly all of it is GxP-classified, and under GxP, the quality regulations governing pharmaceutical data, any system carrying it is a GxP-critical computerized system. Orion, as sponsor, must formally validate that system before go-live and then prove, year after year, that its configuration still matches what was validated.

GxP Kept File Exchange on Servers Orion Ran Itself

Validation assumes the sponsor controls a system's configuration and its change process. A SaaS platform ships features on the vendor's schedule. The standard conclusion in life sciences is that the two cannot be reconciled, so regulated file exchange belongs on infrastructure the sponsor hosts and freezes itself.

Orion lived with what that posture costs. It hosted its own SFTP server for external partner exchange, used Microsoft Azure's native SFTP alongside it to receive partner data, and carried the administration of both.

“The access and user and disk management is a bit painful and not easy there.”

In 2025 an R&D data-sharing program made the arrangement untenable. A widening circle of CROs, universities and public institutions was delivering terabyte-scale omics and bioimaging data, GxP-critical outputs were owed to regulators, and GxP and GDPR obligations applied to all of it: a record of who accessed which dataset, and enforced authentication for every recipient. Scaling the self-run servers meant more of the infrastructure Orion did not want to operate. Moving to the cloud meant answering the question the old posture existed to avoid: how does a sponsor validate a platform it does not host?

That question defined the requirement. Orion needed a platform that could receive files at this scale into Azure storage Orion itself controls, authenticate and log every access, and expose its entire configuration through an API. That would allow Orion to build an automated scraper that could test and baseline the configuration, detect any drift, and evaluate every vendor release against the validated state.

Validation, Not Technology, Set the Five-Week Schedule

Orion selected Files.com as the platform it would classify as GxP-critical and validate itself as sponsor.

The build was compact. Internal users were provisioned from Microsoft Entra ID over SCIM and signed in with SAML single sign-on, so file access followed the corporate directory. Each of the four research workflows in scope—omics and bioinformatics, bioimaging, clinical data, and ad hoc vendor sharing—got its own Files.com workspace. Remote Server Mounts connected those workspaces to Orion's Azure Data Lake Storage, so partner data landed directly in Azure containers Orion owns rather than on Files.com storage. Orion segregated patient-level clinical trial data onto its own Files.com child site with its own administrators, keeping that access management apart from every other user group.

Around that build, Orion ran a full sponsor validation: formal test scripts written against user access management, system validation executed, a validation report issued, and a vendor audit of Files.com, with SOPs, user instructions and a maintenance plan documented ahead of go-live. The whole program took five weeks. Orion's own estimate was that the technical implementation alone could have been as short as five days. The quality system set the pace, not the platform.

Automated Drift Detection Supplies Annual-Review Evidence

Validation does not end at the report. GxP requires ongoing confirmation that the validated configuration still holds, and change is what threatens it.

Files.com exposes its full configuration through its API, with settings exportable in CSV and JSON and permission reports grouped by path or by user. Orion built a configuration scraper against that API. It pulls the live configuration and compares it with the validated baseline, so any drift surfaces as a difference between two exports rather than something a reviewer has to notice. The same exports, together with Files.com access logs and activity history, are the evidence for the annual review that the configuration has held.

Vendor releases go through the same discipline. Orion monitors Files.com release notes as a standing task and evaluates each new feature against the validated configuration before it touches anything.

“If there's a new API endpoint, we add it to the config scraper.”

What Changed Once the Validation Report Was Issued

Since go-live, Orion has replaced a hosting posture with a quality process. Regulated exchange that used to run only on servers Orion froze and administered itself now runs on Files.com inside the GxP quality system. The initial scope supports around 20 external research partners plus tens of clinical partners, with individual inbound deliveries reaching hundreds of gigabytes.

• Terabyte-scale research datasets from CROs, universities and imaging labs, and GxP-critical statistical outputs bound for the FDA and EMA, move through a validated cloud platform—a category of system Orion's old posture ruled out entirely.
• Orion's self-hosted SFTP server and Azure native SFTP no longer carry its external research exchange, and nobody at Orion manages users, access and disks on a server to keep that exchange running.
• Proving the configuration holds is a script's output, not an attestation. The scraper's comparison against the validated baseline stands as evidence at every annual review.
• Vendor releases no longer arrive as uncontrolled change. Each one is evaluated against the baseline through a standing process to determine whether it affects the validated state or requires revalidation.

Validation Became Orion's Process, Not a Reason to Stay Self-Hosted

The question a GxP review asks of any critical system is simple: show that its settings are still what you validated. Orion used to answer it by being the ones running the server. Now the answer is two exports from the Files.com API and the comparison between them, produced by a process Orion's own engineers designed and run. Because the entire configuration of Files.com can be exported and tested, validation stopped being a property of who hosts the hardware and became something the sponsor does: test, baseline, compare, evaluate. Orion did not bend its quality system to fit a cloud platform. It brought the platform inside the quality system and holds it there.