An Orthopedic Practice Replaced ADP-Hosted SFTP With Its First Owned Transfer Layer on Files.com

A US orthopedic specialty practice runs dozens of locations, with surgery centers, diagnostic imaging, and physical, hand, and occupational therapy built into the practice. Behind the clinical operation sits an enterprise back office at real scale. Payroll goes to banks. Benefits enrollment goes to plan administrators. Retirement contributions go to 401(k) vendors. Provider licensing data feeds internal systems. Every one of those movements is a file, on a schedule, passing between the practice's HR system and somebody else's.

And for its entire history, the practice had never owned the layer those files moved on. Every SFTP endpoint it depended on was hosted by a third party.

That had to change in 2025, when the practice consolidated six to eight legacy applications onto Workday. Workday integrations run against SFTP endpoints Workday does not host, and 72 of them were coming, leaving the enterprise applications team to build the first transfer layer the practice had ever owned.

Seventy-Two Integrations and No Endpoints to Run Them On

Most of that hosting came with ADP. The SFTP site behind the majority of the practice's HR integrations belonged to ADP and ran on ADP's terms. The rest of the endpoints belonged to the counterparties themselves.

The one exception was a single-purpose FTP server stood up from a cloud marketplace image, moving one file between two systems. That was the whole estate.

The 72 integrations coming in or out of the new HR system included scheduled feeds to banking, benefits, and 401(k) vendors and to internal systems such as ServiceNow and Epic, carrying HIPAA-regulated data. When ADP retired, the endpoints those feeds ran on retired with it. Without a transfer layer of its own, the consolidation could not complete, because every one of those feeds would lose its transport the day the old system went dark.

The counterparties each had their own requirements, including a national banking partner that mandates PGP-encrypted delivery, and the endpoints had to exist as each Workday module went live, on a program timeline the team did not control.

What the practice needed was a file transfer layer it owned outright: dedicated endpoints under its own name, a separate space and separate credentials for every counterparty, an audit trail that attributes both sides of every transfer, encryption handled inside the platform rather than in scripts, and all of it live in time for the first Workday feed. Files.com met that combination of requirements and became the first file transfer platform the organization had ever owned.

One Site, a Folder and Two Accounts for Every Integration

Files.com became the single endpoint every counterparty connects to when the practice supplies the endpoint: one site, running under the practice's own branded domain with dedicated IP addresses, structured so that dozens of integrations stay separate, permissioned, and attributable.

The structure was set before the scale arrived. A subfolder isolates each integration, while two accounts—one for each side of the exchange—make every action attributable. Administrators sign in through the practice's Entra ID single sign-on. External vendors and system accounts get password credentials scoped to their own folders and nothing else.

The first two workflows went live immediately. A one-directional feed carries current provider licensing data from CredentialStream into ServiceNow on a schedule, with no one touching it. A second channel let finance and project staff exchange sensitive Workday project files with the outside consulting group running the implementation, internal staff through the web interface behind SSO and consultants over SFTP. That channel was deliberately temporary and ended with the project. From there, integrations were added as each Workday module deployed: HCM, then Finance, then supply chain.

Encrypted Bank Files, Decrypted on Arrival

One of the practice's national banking partners requires PGP-encrypted file exchange. The usual way to meet that mandate is GnuPG scripts and a private key sitting on a server somebody has to maintain. On Files.com it is a folder configuration. The keys live in the Files.com GPG Key Manager. The bank delivers encrypted files over SFTP, Files.com decrypts each file automatically on arrival, and Workday pulls the decrypted file on its normal schedule. Workday never handles a key, the bank never changes how it sends, and no one on the team runs a decryption step by hand. The exchange went from design to production in a matter of months.

The Standard SFTP Provider for ERP Integration

By October 2025, with the Workday program through its major go-lives, the practice had replaced a patchwork of vendor-hosted endpoints with a single transfer platform it operates itself.

• Six to eight legacy applications were retired in the consolidation, ADP among them.
• Roughly half of the 72 Workday integrations identified at onboarding were scoped to Files.com, everywhere the practice rather than the counterparty supplies the endpoint, and they came online as each Workday module deployed.
• Scheduled feeds between Workday and its banking, benefits, and retirement-plan vendors run unattended, with an audit log that attributes both sides of every transfer of HIPAA-regulated data.
• Encrypted exchange with its banking partner runs end to end, with no key or file touched by hand.

The result that compounds is the pattern. Onboarding the next vendor is a subfolder, a pair of credentials, and, where the partner requires it, an encryption key, all on a platform that already exists. There is no hosting arrangement to negotiate and no third party to wait on. The enterprise applications team operates the entire estate.

A File Transfer Layer of Their Own

Today, the enterprise applications team controls the practice's Files.com site and the integrations running through it. The Workday migration could have rebuilt the old dependency counterparty by counterparty, each partner hosting its own piece of the practice's file transfer. Instead the practice stood the layer up once, on Files.com, and each integration for which the practice supplies the endpoint has landed on it.