Space Coast Credit Union Builds a Self-Clearing Legal File Exchange With Files.com

Space Coast Credit Union is the third-largest credit union in Florida. Member-owned and state-chartered, it serves more than 685,000 members across 34 counties along Florida's east coast, holds over $9 billion in assets, and operates under NCUA regulation, providing checking and savings, lending, mortgages, and credit cards.

A financial institution of that size is a standing party to legal process. Subpoenas arrive. Law enforcement requests member records. Litigation puts documents in motion between the credit union and its outside counsel. Every one of those exchanges has the same shape: sensitive material, a hard deadline, and a named individual on the other end who is outside the organization by definition.

Files.com gave SCCU a governed channel built for that boundary: one isolated folder per exchange, MFA for every outside visitor, and automatic deletion of files left untouched for 45 days. The legal work could move without leaving a permanent second repository behind.

Subpoena and Litigation Files With No Governed Way Out

None of SCCU's internal systems could face that exchange. SharePoint is not exposed outside the organization, and security policy tightly constrains what can face the public internet at all. The counterparties could not be brought inside either. An investigator or an outside attorney is not getting an account in a credit union's directory, and some partners run no shared file service of any kind on their own side.

SCCU needed more than a message carrying an attachment. There had to be a folder to scope access to, a way to say that one party may upload and another may only download, an expiration rule once the exchange ended, and a clean record of who retrieved what. For an NCUA-regulated institution moving subpoena responses and lawsuit documents, every exchange carried those requirements, usually with no lead time at all.

The fix had to do four things. Be reachable by any outside party in a browser, with nothing to install and no account in any internal system. Scope access per request, so each party could touch only its own exchange. Authenticate every visit. And never quietly grow into a repository of legal documents.

An Isolated Folder, Named Invitations, and MFA for Every Request

SCCU selected Files.com to be that channel. Rhode configured the site himself and made it usable for the legal and subpoena transfer case.

The pattern he established is the one still running. When a request comes in, the person handling it creates a folder for that exchange and isolates it. The specific individuals named in the request are invited to that folder and nothing else. Folder-level permissions on Files.com decide, per relationship, whether a party can upload, download, or both. Two-factor authentication is enforced across the entire site, so every outside visitor verifies with a one-time code before touching a file. Every action lands in the audit trail, so the record of what a given partner or user touched is a lookup rather than a reconstruction.

Anything Untouched for 45 Days Goes Away

Rhode's design rule for the platform was that it stay a transfer product, never a repository. The enforcement is Files.com's global file expiration: any file not modified for 45 days is deleted, site-wide, and the policy was applied retroactively to files already uploaded.

A legal exchange therefore lives on the platform exactly as long as the exchange is live. Once the work goes quiet, the material removes itself. There is no cleanup task on anyone's list, no growing archive of subpoena responses to secure, and no second copy of sensitive member data accumulating outside the systems built to hold it.

Answering a Request Is Now a Folder and an Invitation

With the Files.com pattern in production, SCCU replaced ad hoc handling with a repeatable, governed procedure for legal and law-enforcement file exchange.

• Answering a subpoena or law-enforcement request means creating a folder, inviting the named individuals, and opening the exchange, with no account provisioned in any internal system and nothing for the outside party to install.
• Each counterparty reaches exactly one folder, behind two-factor authentication, with only the upload or download rights that exchange needs. That holds even for partners who operate no shared file service of their own.
• Closed exchanges clean themselves up. The 45-day expiration deletes whatever the work leaves behind, automatically and without exception.
• Every exchange leaves a record of what each invited party uploaded and downloaded, ready for the audit questions a regulated institution gets asked.

The procedure has also outgrown its author. Day-to-day ownership of the platform has moved from IT engineering to the application support team, and the same isolate-and-invite pattern applies to any outside party SCCU needs to exchange files with. The next request costs a folder and an invitation.

A Transfer Channel, Not a Repository

The expiration rule is what makes the channel sustainable. A secure external exchange is easy to stand up, and just as easy to let rot into one more unmanaged store of sensitive documents. SCCU's retention rule keeps Files.com the former: the way legal files cross the organization's boundary, never the place they live.