A Pharmaceutical Supply-Chain Network Uses Files.com to Control Audit Evidence for Its Customers Beyond Dropbox, Egnyte, and ShareFile

A pharmaceutical supply-chain network provider operates the digital network that pharmaceutical supply chains use to prove compliance. Drug manufacturers, distributors, and dispensers exchange serialization and traceability data through its platform. When a pharmaceutical company has to prove where a drug has been, the network is the system that holds the answer.

That position cuts both ways. A company whose product is compliance evidence gets held to the same standard by the people who depend on it. More than a thousand of the company’s customers audit it directly.

Audited by More Than a Thousand of Its Own Customers

With more than a thousand auditing customers on rolling one-to-three-year cycles, audit response at the company is not an event. It is a continuous stream of overlapping reviews, and every one of them is conducted by a paying customer.

For each audit, the company’s Regulatory and Quality team provides dozens of documents, a mix of PDFs and video, that the customer uses to assess the company’s compliance. The set is largely the same from customer to customer, and some of the documents are refreshed every one to two months.

The team set two hard requirements for how that evidence could be shared. External reviewers must not be able to download the documents. And the audit trail must show exactly which documents each reviewer opened.

Both requirements come from the same place: the evidence describes the company’s own internal controls, and the team wanted every copy of it to stay under its control. Findings can arrive up to 30 days after a review ends. When one does, the company needs to show, from a per-document record, what that specific reviewer actually looked at.

What Dropbox, Egnyte, and ShareFile Could Not Prove

The company’s file sharing at the time ran on Dropbox, Egnyte, and ShareFile. All three could deliver a document to an outside party. None could enforce preview-only access, and none logged at the level of the individual document.

And the audit stream never pauses. With reviews from more than a thousand customers arriving on rolling cycles, anything improvised per audit could not keep up with the calendar. The company needed a standing pattern.

What that pattern had to do was specific. Put an external reviewer in front of dozens of documents and nothing else. Let them read everything and download nothing. Open the room for two weeks per audit and close it after. Log which documents each reviewer opened, and keep that log through the 30-day window in which findings arrive. And hold the evidence set in one place, so a refresh every month or two reaches every audit without redistributing files.

The company selected Files.com to be that room.

A Preview-Only Room That Opens for Two Weeks

For each customer audit, the company grants the reviewers access to the evidence set on Files.com for a two-week window. Access is preview-only: Files.com renders the PDFs and videos in the browser, and download is not among the actions a reviewer is permitted. The reviewer reads the evidence without receiving a downloaded copy through the workflow.

While the room is open, Files.com’s audit trail records each reviewer’s activity per document. The log remains available through the 30-day window in which findings can arrive.

The evidence set itself lives in one place on Files.com. When the Regulatory and Quality team updates a document, the current version is what every subsequent reviewer sees. Nothing is re-sent, and the workflow does not create another downloaded copy each time the evidence changes.

One Pattern for Every Audit

With audit response running on Files.com, the company replaced delivery through three separate sharing tools with one controlled pattern it applies to every audit.

That changed the Regulatory and Quality team’s work. Opening the next audit means granting access, not building anything. Refreshing a document is one update in one place. When a finding arrives, the answer is a lookup in the per-document record. More than a thousand customers on rolling cycles means the audit stream never ends, but a new customer joining the rotation adds a grant of access, not a project.

Proof of Control, Turned on Itself

The company’s product is proof of control: the ability to show, for any serialized medicine, exactly where it has been and who handled it. Today, when one of its own customers turns that scrutiny back on the company, it answers in kind. When your customers audit you, the deliverable is not the documents. It is proof of control over them, and Files.com is where the company keeps that proof.