TraceLink Uses Files.com to Control Audit Evidence for 1,000+ Customers Beyond Dropbox, Egnyte, and ShareFile

TraceLink operates the digital network that pharmaceutical supply chains use to prove compliance. Drug manufacturers, distributors, and dispensers exchange serialization and traceability data through its platform. When a pharmaceutical company has to prove where a drug has been, TraceLink is the system that holds the answer.

That position cuts both ways. A company whose product is compliance evidence gets held to the same standard by the people who depend on it. More than 1,000 of TraceLink’s customers audit the company directly.

Audited by More Than 1,000 of Its Own Customers

With over 1,000 auditing customers on rolling one-to-three-year cycles, audit response at TraceLink is not an event. It is a continuous stream of overlapping reviews, and every one of them is conducted by a paying customer.

For each audit, TraceLink’s Regulatory and Quality team provides roughly 50 documents, a mix of PDFs and video, that the customer uses to assess TraceLink’s compliance. The set is largely the same from customer to customer, and some of the documents are refreshed every one to two months.

The team set two hard requirements for how that evidence could be shared. External reviewers must not be able to download the documents. And the audit trail must show exactly which documents each reviewer opened.

Both requirements come from the same place: the evidence describes TraceLink’s own internal controls. A downloaded copy outlives the audit, travels beyond it, and can never be called back. And findings can arrive up to 30 days after a review ends. When one does, TraceLink needs to show what that specific reviewer actually looked at. Without a per-document read trail, there was no way to answer a finding from the record.

What Dropbox, Egnyte, and ShareFile Could Not Prove

TraceLink’s file sharing at the time ran on Dropbox, Egnyte, and ShareFile. All three could deliver a document to an outside party. None met the needs of a workload where delivery is the easy part and the deliverable is the control evidence itself. A tool that hands the reviewer the file has already failed the first requirement. A tool that logs at the level of links or sessions cannot satisfy the second.

And the audit stream never pauses. With reviews from more than 1,000 customers arriving on rolling cycles, anything improvised per audit could not keep up with the calendar. TraceLink needed a standing pattern.

What that pattern had to do was specific. Put an external reviewer in front of about 50 documents and nothing else. Let them read everything and download nothing. Open the room for two weeks per audit and close it after. Log which documents each reviewer opened, and keep that log through the 30-day window in which findings arrive. And hold the evidence set in one place, so a refresh every month or two reaches every audit without redistributing files.

TraceLink selected Files.com to be that room.

A Preview-Only Room That Opens for Two Weeks

For each customer audit, TraceLink grants the reviewers access to the evidence set on Files.com for a two-week window. Access is preview-only: Files.com renders the PDFs and videos in the browser, and download is not among the actions a reviewer is permitted. The reviewer reads the evidence without receiving a downloaded copy through the workflow.

While the room is open, Files.com’s audit trail records each reviewer’s activity per document. The log remains available through the 30-day window in which findings can arrive.

The evidence set itself lives in one place on Files.com. When the Regulatory and Quality team updates a document, the current version is what every subsequent reviewer sees. Nothing is re-sent, and the workflow does not create another downloaded copy each time the evidence changes.

One Pattern for Every Audit

With audit response running on Files.com, TraceLink replaced ad hoc delivery through three separate sharing tools with one controlled pattern it applies to every audit.

That changed the Regulatory and Quality team’s work. Opening the next audit means granting access, not building anything. Refreshing a document is one update in one place. When a finding arrives, the answer is a lookup in the per-document record. More than 1,000 customers on rolling cycles means the audit stream never ends, but a new customer joining the rotation adds a grant of access, not a project.

Proof of Control, Turned on Itself

TraceLink’s product is proof of control: the ability to show, for any serialized medicine, exactly where it has been and who handled it. Today, when one of its own customers turns that scrutiny back on TraceLink, the company answers in kind. When your customers audit you, the deliverable is not the documents. It is proof of control over them, and Files.com is where TraceLink keeps that proof.