SumUp Scales EU-Resident Merchant Data Exchange Beyond 500 Accounts With Files.com

SumUp builds payment infrastructure for small merchants, including card readers, point-of-sale systems, and business banking services.

A business built that way runs on data about its merchants, and operating it means exchanging some of that data with outside parties. Under European privacy law, that kind of exchange came with a condition attached before any workflow question could be asked: where the files physically lived.

Over nine years in production, SumUp's file-exchange footprint more than doubled from under 250 users to over 500. Files.com kept the growing workload on EU-resident storage without turning that growth into a new infrastructure project.

Where the Data Lives Was the Gating Question

In 2017, SumUp's Information Security Officer set the requirement for any service that would carry information about SumUp's customers: file storage in the EU, for privacy reasons, and entirely. The question he pressed was not whether an EU region was available, but whether every byte could reside in a single EU region with nothing remaining in the United States. Residency was not a feature to weigh against other features. It was the condition of using a file-exchange service at all.

GDPR then turned the condition into a deadline. SumUp's data storage had to be in Europe before enforcement began in 2018.

The exchange also had to support SFTP and administer hundreds of named user accounts as a service rather than as infrastructure SumUp would have to build and operate inside the EU. SumUp selected Files.com to be that exchange.

Residency as a Setting, Not an Infrastructure Project

Files.com became the EU-resident layer between SumUp's own systems and the outside parties it exchanged merchant information with.

Storage residency was handled by Files.com's geographic region selection. In 2018, SumUp's file storage was placed in an EU region, and it has resided there since. Every file that lands on the exchange lands in EU storage. The residency guarantee is a property of the site itself, not a rule anyone applies transfer by transfer.

Counterparty access ran over SFTP, a standard protocol. Each user had a named account on the site, so hundreds of accounts could be administered in one place with their own credentials.

Nine Years in Production at More Than Double the Scale

With the exchange running on EU-resident storage, SumUp replaced a compliance blocker with a configured property of its platform. What followed is the strongest evidence for the design:

• The exchange has run continuously in production since 2017, carrying processes SumUp described as critical.
• Its user population has more than doubled, from under 250 in 2017 to over 500 by 2026.
• The same Files.com site absorbed that growth through additional named accounts, with each new user's files residing in the EU from the first byte.

An Exchange That Carries Its Compliance With It

The condition the security team set in 2017, that all of it live in the EU, travels with every file. An EU residency mandate on customer data exchange did not have to become an infrastructure project inside the EU. Files.com satisfied it at the file-transfer layer, where geographic region selection keeps storage in Europe as the exchange grows.