Reformation Retired Three Unowned SFTP Servers with Files.com—Without Rewriting Its Integrations

Reformation is a premium direct-to-consumer sustainable fashion brand, and its operation is unusually vertical for fashion. The company designs its own clothing, manufactures in its own Los Angeles factory, and sells through its e-commerce channel and roughly 50 retail stores.

An operation like that runs on file exchange, even though nothing about it looks like a file-transfer business. Orders come off the e-commerce platform as XML for the order management system. Shipping carriers and product-feed platforms read and write data every day. HR and payroll systems trade CSVs of employee pay data for staff in three countries. The file-transfer layer underneath all of it had grown up one integration at a time, with nobody in particular owning it. Reformation ultimately retired all three servers with Files.com without rewriting the order, payroll, and vendor integrations that depended on them.

Payroll, Orders, and Vendor Feeds on Servers Nobody Could Vouch For

By 2024, that layer was three self-managed SFTP servers. One ran in GCP, administered by a member of the data team, and nobody could say when it had last been patched. One sat on GoDaddy hosting. A third had been stood up on yet another hosting service specifically to hold employee PII. Thane Shubaly, Reformation's VP of Engineering, described them as workhorses, some of them business critical, and was frank that he had little faith in his team's ability to manage them.

The work crossing those servers was anything but marginal. Inbound CSVs from ChartHop, the HR system, and Paychex, the payroll provider, kept pay and terminations in sync for employees in the US, Canada, and the UK. Logistics carriers including FedEx and UPS, along with product-feed, marketing, and EDI platforms, exchanged files daily. And the handoff Reformation considers absolutely mission critical, Salesforce Commerce Cloud dropping order XML to the order management system, ran as a file drop on an SFTP path.

The cost showed up in two places. Vendors were not confined to their own spaces, so there was no way to guarantee that one partner could never reach another's files. And anyone administering the servers had standing access to employee pay data, with no log that could prove who had looked at what. Shubaly's own view was that not even he should hold that access. All of this sat against a SOC 2 Type 2 posture the company was holding itself to.

The annual penetration test brought that risk into focus. While assembling its inventory of systems with the test underway, the team already recognized the SFTP estate as the area where it felt most vulnerable. The MOVEit and SolarWinds breaches had sharpened concern about continuing to carry unpatched legacy infrastructure.

A Drop-In Replacement or Nothing

The estate had survived this long because everything was integrated against it. Internal scripts picked vendor CSVs off those servers and loaded them into BigQuery. The order flow depended on its SFTP drop. External partners had credentials and automations pointed at existing paths. A replacement that forced changes to those processes would be a deal breaker.

The team also had no intention of building the missing controls themselves on top of self-managed boxes. That was precisely the work nobody had time for.

“Unload that critical service or capability on somebody else who thinks about it much more than any of us have time to think about it.”

So the requirements wrote themselves: hosted SFTP that existing scripts and vendors could point at without rework, a silo per vendor that no other vendor could see, SSH key authentication for the partner that required it, encryption in transit and at rest, permissions tight enough to keep pay data to a handful of people, and a log that could prove after the fact who accessed what. Reformation selected Files.com to be that platform.

One Silo per Vendor, Every Access in the Log

Underneath the automation, nothing moved. The internal scripts that collected vendor CSVs and loaded them into BigQuery still collected from an SFTP path; the path now terminated at Files.com. Salesforce Commerce Cloud still dropped order XML for the order management system the same way it always had. The servers changed, and the mechanics the business depended on did not.

Each external partner moved onto its own isolated Files.com account, with permissions scoped so that no vendor can see that any other exists. The partner that required SSH key authentication connects with keys rather than a password.

The HR and payroll exchange got the tightest treatment. ChartHop and Paychex deliver their CSVs into a space where access is restricted to fewer than five people, data is encrypted in transit and at rest, and every access lands in the audit log. If anyone ever questions whether an administrator looked at pay data, the logs can answer. That was Shubaly's requirement, and it is now simply how the system works.

Three Servers Retired, Nothing Rewritten

With the migration done, Reformation replaced an estate of unowned servers with one governed platform:

• The GCP server, the GoDaddy server, and the standalone PII server are gone, and Reformation's engineers no longer patch or maintain any SFTP infrastructure.
• Vendor traffic is siloed. Each partner works in its own account and cannot reach another partner's data, a guarantee the old estate could never make.
• Access to employee pay data is held to fewer than five people and every access is logged, so payroll stays in sync across three countries without anyone holding unprovable access to it.
• The mission-critical order flow runs on managed infrastructure rather than a server nobody could vouch for.

The change also compounds. Onboarding the next partner is an isolated account and a set of permissions, not another server somebody on the engineering team has to own for the rest of its life.

File Transfer Became Someone Else's Full-Time Job

Today, Reformation's engineers build the commerce stack and the data pipelines, and none of them runs a file server on the side. The burden of patching and maintaining SFTP infrastructure now sits outside the internal engineering team.

The servers were retired rather than hardened, and every script, vendor integration, and order flow that depended on them kept running exactly as before. The paths stayed. Only what stood behind them changed.