A Pharmaceutical Company Moves Research Exchange From Self-Hosted SFTP to GxP-Validated Files.com in Five Weeks

A European pharmaceutical company develops, manufactures and markets medicines and the active ingredients behind them, and runs its own pharmaceutical R&D.

That research engine runs on data that comes from outside the company. Sequencing and bioimaging datasets arrive from contract research organizations, universities and imaging labs, with single files reaching hundreds of gigabytes and whole datasets reaching terabyte scale. Final statistical reports and SAS analysis outputs travel the other way, to the FDA and the EMA. Nearly all of it is GxP-classified, and under GxP, the quality regulations governing pharmaceutical data, any system carrying it is a GxP-critical computerized system. The company, as sponsor, must formally validate that system before go-live and then prove, year after year, that its configuration still matches what was validated.

GxP Kept File Exchange on Servers the Company Ran Itself

Validation assumes the sponsor controls a system's configuration and its change process. A SaaS platform ships features on the vendor's schedule. The standard conclusion in life sciences is that the two cannot be reconciled, so regulated file exchange belongs on infrastructure the sponsor hosts and freezes itself.

The company lived with what that posture costs. It hosted its own SFTP server for external partner exchange, used Microsoft Azure's native SFTP alongside it to receive partner data, and carried the administration of both.

In 2025 an R&D data-sharing program made the arrangement untenable. A widening circle of CROs, universities and public institutions was delivering terabyte-scale omics and bioimaging data, GxP-critical outputs were owed to regulators, and GxP and GDPR obligations applied to all of it: a record of who accessed which dataset, and enforced authentication for every recipient. Scaling the self-run servers meant more of the infrastructure the company did not want to operate. Moving to the cloud meant answering the question the old posture existed to avoid: how does a sponsor validate a platform it does not host?

That question defined the requirement. The company needed a platform that could receive files at this scale into Azure storage it controls itself, authenticate and log every access, and expose its entire configuration through an API. That would allow the company to build an automated scraper that could test and baseline the configuration, detect any drift, and evaluate every vendor release against the validated state.

Validation, Not Technology, Set the Five-Week Schedule

The company selected Files.com as the platform it would classify as GxP-critical and validate itself as sponsor.

The build was compact. Internal users were provisioned from Microsoft Entra ID over SCIM and signed in with SAML single sign-on, so file access followed the corporate directory. Each of the four research workflows in scope—omics and bioinformatics, bioimaging, clinical data, and ad hoc vendor sharing—got its own Files.com workspace. Remote Server Mounts connected those workspaces to the company's Azure Data Lake Storage, so partner data landed directly in Azure containers the company owns rather than on Files.com storage. The company segregated patient-level clinical trial data onto its own Files.com child site with its own administrators, keeping that access management apart from every other user group.

Around that build, the company ran a full sponsor validation: formal test scripts written against user access management, system validation executed, a validation report issued, and a vendor audit of Files.com, with SOPs, user instructions and a maintenance plan documented ahead of go-live. The whole program took five weeks. The company's own estimate was that the technical implementation alone could have been as short as five days. The quality system set the pace, not the platform.

Automated Drift Detection Supplies Annual-Review Evidence

Validation does not end at the report. GxP requires ongoing confirmation that the validated configuration still holds, and change is what threatens it.

Files.com exposes its full configuration through its API, with settings exportable in CSV and JSON and permission reports grouped by path or by user. The company built a configuration scraper against that API. It pulls the live configuration and compares it with the validated baseline, so any drift surfaces as a difference between two exports rather than something a reviewer has to notice. The same exports, together with Files.com access logs and activity history, are the evidence for the annual review that the configuration has held.

Vendor releases go through the same discipline. The company monitors Files.com release notes as a standing task and evaluates each new feature against the validated configuration before it touches anything.

What Changed Once the Validation Report Was Issued

Since go-live, the company has replaced a hosting posture with a quality process. Regulated exchange that used to run only on servers the company froze and administered itself now runs on Files.com inside the GxP quality system. The initial scope supports tens of external research and clinical partners, with individual inbound deliveries reaching hundreds of gigabytes.

• Terabyte-scale research datasets from CROs, universities and imaging labs, and GxP-critical statistical outputs bound for the FDA and EMA, move through a validated cloud platform—a category of system the company's old posture ruled out entirely.
• The company's self-hosted SFTP server and Azure native SFTP no longer carry its external research exchange, and nobody at the company manages users, access and disks on a server to keep that exchange running.
• Proving the configuration holds is a script's output, not an attestation. The scraper's comparison against the validated baseline stands as evidence at every annual review.
• Vendor releases no longer arrive as uncontrolled change. Each one is evaluated against the baseline through a standing process to determine whether it affects the validated state or requires revalidation.

Validation Became the Company's Process, Not a Reason to Stay Self-Hosted

The question a GxP review asks of any critical system is simple: show that its settings are still what you validated. The company used to answer it by being the ones running the server. Now the answer is two exports from the Files.com API and the comparison between them, produced by a process the company's own engineers designed and run. Because the entire configuration of Files.com can be exported and tested, validation stopped being a property of who hosts the hardware and became something the sponsor does: test, baseline, compare, evaluate. The company did not bend its quality system to fit a cloud platform. It brought the platform inside the quality system and holds it there.