Tabacalera Replaced Password-Protected Workday Payroll ZIPs With Automated Files.com GPG Encryption

Tabacalera is a Spanish cigar manufacturer and distributor with about 4,000 employees and operations across EMEA. An operation with that spread runs on files. A logistics partner, finance and HR systems, and the main business exchange stock levels, invoices, payroll, and other workforce data continuously.

Some of those files carry personal information about employees. Sensitive personal-data transfers were prepared manually as password-protected ZIPs, leaving protection dependent on someone remembering the step for every file and every payroll cycle.

One Interface Platform Between Partners and Systems

Tabacalera runs that interchange through Files.com. Recurring feeds from its logistics partner, Logista, flow through the platform into the main business. Payroll and HR files move to Workday, while NetSuite and Sage connect on the finance side.

Most of that traffic is operational. Stock levels and invoices matter commercially, but the HR lane is different. Payroll files carry employees’ personal details, the raw material of identity theft, and those were the files still being protected by hand.

Payroll Files, Protected by Hand

Every transfer of sensitive personal data was prepared manually as a password-protected ZIP. That made the company’s protection for its most sensitive data exactly as good as a habit. It held only when a person remembered the step, on every file, every payroll cycle. And even when the habit held, the model had a structural gap. Encryption in transit and at rest protects a file from outsiders, but a stolen credential is an insider: whoever holds it can download the file and read it.

Tabacalera’s legal counsel put a name on that exposure. The personal information in those files could enable identity theft, and it needed to travel encrypted as content, not just over an encrypted connection. The lawyers recommended it, and the IS team treated the recommendation as a requirement.

The manual ZIPs had survived that long because proper encryption is where these projects usually stall. GPG normally means key pairs, keyrings, and tooling, and the people uploading payroll files work in HR, not IT. Asking them to run encryption software on every file trades one fragile manual step for a harder one. The obvious automated design fails a different way: if inbound files are decrypted into a folder for a downstream system to collect, the exposure has just moved one step down the chain, with cleartext waiting on the platform.

So the fix had to do three things at once. It had to encrypt every sensitive file without the uploader doing anything, keep keys away from the people handling the files, and never let decrypted data rest anywhere. Tabacalera built that workflow on Files.com folder-level GPG encryption.

Encrypted on Upload, Never Left Readable at Rest

With Files.com GPG encryption configured on the folders that carry personal data, encryption happened on upload. An HR employee dropped a payroll file into the designated folder, and the platform encrypted it automatically with the configured key. There was no password to choose and no tool to run. Uploading a sensitive file looked exactly like uploading any other file, and the keys lived in the platform’s GPG Key Manager rather than on anyone’s workstation, so no one in HR handled one.

The downstream workflow was designed with the same discipline. A service account carried files through decryption and moved the decrypted result off the platform immediately, rather than leaving readable payroll data waiting in a folder for a later job to collect.

Payroll files bound for Workday run through this encrypted workflow today.

Protection That No Longer Depends on Anyone’s Diligence

With the encrypted workflow live, Tabacalera replaced a per-file manual safeguard with one the platform enforces.

• A file at rest on the transfer layer is ciphertext. A compromised credential yields nothing readable, closing the exposure legal counsel flagged.
• Extending the same protection to another sensitive flow requires a folder setting and a key, not a new process for employees to learn.

A Safeguard Built Into the Path the Files Already Take

What changed is where the safeguard lives. Before, Tabacalera’s defense against identity-theft exposure was a person remembering to password-protect a ZIP, and it was only ever as strong as the last time someone remembered. Now an HR employee preparing a payroll run does what they always did, drops the file into a folder, and the encryption has already happened by the time anyone could go looking for the data.

A recommendation from the company’s own lawyers was enough, because Files.com made following it cost nothing in anyone’s working day. Tabacalera did not ask its people to learn encryption. It built the encryption into the path the files already take.