A Pharmaceutical Company Verifies and Forwards Terabytes of GxP Acquisition Data With Files.com

A global pharmaceutical company's US arm builds its portfolio through acquisition and divestiture. The business operates under FDA GxP regulation.

Every one of those transactions runs on a Transition Service Agreement, and every TSA obligates the counterparty to deliver the product's regulated data by a contractual date: clinical study folders, raw scientific datasets, the documentary history of a drug. GxP rules mean none of it can simply be accepted. Each delivery has to be checked, file by file, against the data delivery and migration plans written into the contract before the business treats it as received. Underneath the deal-making, the US business has to move terabytes of regulated data on contract deadlines, over and over.

Terabytes of Regulated Data on a Contract Deadline

The business unit wanted an SFTP service of its own to receive it. A typical acquisition delivers terabyte-scale data from the counterparty, and outliers run far larger. The destinations dictated the protocol: the unit's two Veeva Vaults, the final home for regulated clinical data, accept bulk transfer only over SFTP, and multi-terabyte scientific datasets are impractical to move any other way.

The unit also wanted a service it runs itself: delivered as a service, ready for the next deal without a new infrastructure project, and administered by the senior applications-development specialist who owns GxP data movement for the unit's M&A integrations. The pattern repeats with every deal in the pipeline, so the service had to be repeatable too.

It had to speak SFTP in both directions. It had to keep each counterparty's feed segregated from every other. It had to produce a complete, verifiable index of every delivery, because GxP approval rests on proving exactly what arrived. And it had to move approved data onward into Box, the unit's compliance-approved system of record, and into the two Veeva Vaults. The US business selected Files.com to be that SFTP service.

Stage, Verify Against the Manifest, Then Forward to Box and Veeva

Files.com became the staging layer between every acquisition counterparty and the unit's regulated systems of record: the place where data lands, is held, and is proven before the business lets it move.

Each incoming data stream gets its own Files.com user and segregated folder tree, created per project or vendor. Selected sensitive folders also carry Files.com GPG encryption.

Before anything moves downstream, the specialist exports the full folder listing to CSV through the Files.com CLI: every file name, size, and MD5 hash. That listing is reconciled against the counterparty's own manifest and goes into the internal reports that document the transfer, so business approval rests on a file-by-file record of what actually arrived rather than an assumption that everything did.

Once the business signs off, Files.com forwards approved data to Box through a Remote Server Mount and to the two Veeva Vaults over SFTP. Forwarded data then stays in Files.com under an archival hold.

Nothing in the pattern belongs to any one deal. The next acquisition means a new user, a new folder tree, the same manifest reconciliation, and the same destinations.

Terabytes of DNA Sequencing Data, Three Destinations, One Month

With the workflow in production, the data side of a pharmaceutical acquisition stopped being an infrastructure question and became a repeatable process. In one acquisition, terabytes of raw DNA sequencing data were received over SFTP, staged, verified against the vendor's manifest, and forwarded to Box and both Veeva Vaults inside a single month. The contractual deadline was met.

Files.com is now the business unit's SFTP service for regulated data movement, with administration handled inside the business unit for terabyte-scale, GxP-regulated migrations through the same ingest, verify, and forward pattern.

An SFTP Service No Deal Has to Wait For

Today, when the company closes its next pharmaceutical deal, receiving the counterparty's data no longer requires a new infrastructure project. The specialist creates the user, the counterparty gets its SFTP credentials, and the same Files.com pipeline that carried the last acquisition's data carries this one's, manifest reconciliation and all.

Files.com gives the business what GxP approval demands: segregated access per counterparty and a hash-level record of every file that arrived, on a service the unit runs itself. The part of the deal that regulation might have made slowest, moving the data itself, now runs on the deal's own clock.