An Accounts-Receivable Management Firm Took SFTP Administration In-House With Files.com—Without Taking on the Server

An accounts-receivable management firm handles third-party debt collection and collections litigation support, working with clients and outside law firms on portfolios across the United States. Some of its work involves healthcare receivables, which means medical accounts and protected health information.

That work runs portfolio by portfolio. A client places a portfolio of accounts, and the firm exchanges batch files with that client, and with the outside law firms litigating those accounts, for as long as the engagement runs. Those files can carry consumer PII and, on medical accounts, PHI. File exchange sits at the front of the firm’s client relationships.

Adding a User Meant Filing a Work Order With Another Company

For years, that exchange ran on an on-prem SFTP server that the firm neither hosted nor administered. The server belonged to a broader infrastructure stack operated by an outside managed-service provider, and every basic administrative task went through that vendor. Adding a user meant filing a work order and waiting.

The cost landed at the start of every engagement. Onboarding a new client portfolio, or giving a partner law firm a login, was the first thing a new relationship asked for, and it sat in another company’s ticket queue. The firm’s team had no way to create users or share logins on its own timeline. The firm wanted the administration, and the compliance posture behind it, in its own hands.

The problem persisted because the SFTP server was not a standalone system anyone could swap out. It was embedded in the vendor-supported stack, so fixing file transfer meant pulling the workload out of the MSP relationship entirely. And any replacement had a hard floor: it had to carry regulated data, including PHI under a HIPAA business associate agreement, from its first day in production.

What the fix had to do was specific. An SFTP endpoint the firm could administer itself: users created, logins shared, and per-portfolio folder structures stood up the moment a request arrived. Separation between clients and law firms, portfolio by portfolio. A HIPAA BAA covering the medical accounts. And none of it could mean the firm taking on the hosting and operating of a file transfer server. The firm wanted to own the administration, not the machine.

The firm selected Files.com as that endpoint.

An SFTP Site the Firm Administers Itself

Files.com gave the firm a managed SFTP platform where the administration belongs to the customer and the infrastructure belongs to Files.com. The BAA was in place from the outset, covering PHI on the medical accounts.

The structure mirrors how the business works. Each external party, whether a client or a partner law firm, has a portfolio-scoped folder structure, with users permissioned only to their own portfolios. Files move in both directions over SFTP, so counterparties connect with whatever standard client they already use, and the firm’s own staff work through the Files.com web client alongside their desktop SFTP tools.

Provisioning is the part that changed hands. The firm’s team creates users, sets up directories, and manages permissions directly in the Files.com web client. The whole configuration was built and is maintained in-house by a single operations analyst. Internal staff sign in through Microsoft Entra ID SSO, so identity for the firm’s own users comes from the directory the firm already manages.

In 2024, the Rest of the SFTP Workload Followed

The first wave replaced the MSP-hosted server. The second came in 2024, when the firm migrated off its hosted infrastructure vendor and rebuilt its infrastructure in-house. It did not stand up its own SFTP server as part of that build. It cut the vendor’s remaining SFTP workload over to Files.com wholesale.

From Ticket-and-Wait to Handling Requests In-House

With the Files.com endpoint in production, the firm replaced an administration cycle routed through an outside vendor’s ticket queue with access handled by its own team when the request arrives.

• Onboarding a new client portfolio or a law-firm login is handled by the firm’s own staff when the request arrives. No work order leaves the building.
• PHI on medical accounts moves under a HIPAA BAA that has been in place from the start.
• The roster of client, law-firm, and internal logins has grown substantially since provisioning came in-house, absorbed by the same team, with the configuration still maintained by one operations analyst.
• File transfer is no longer tied to any vendor’s infrastructure. When the firm rebuilt its stack in-house, the transfer layer consolidated onto Files.com instead of becoming one more system to host.

Owning the Administration, Not the Server

The firm never needed to run an SFTP server. It needed to control who could reach one: which clients, which law firms, which portfolios, under what compliance posture. Files.com separated those two things. The administration came in-house, with the entire configuration maintained by the firm’s own team, while the server stayed somebody else’s job. When the firm later brought the rest of its infrastructure in-house, file transfer was the one workload it chose not to take back, because the part worth owning, it already owned.