A Regional Transit Agency Automates Four ADP Feeds with Files.com—Without Putting Plaintext in the Cloud

A regional public transit agency runs bus, rail and paratransit service across a multi-city region.

Running that service takes more than a thousand employees: operators, mechanics, dispatchers, administrators. Paying and administering them spans systems on both sides of the agency's own network. HR and payroll records originate in the agency's on-premises HCM system, while payroll processing and benefits administration happen at outside providers, with ADP first among them. On every cycle, files carrying salary data and protected health information had to leave the agency's servers, reach those providers encrypted, and arrive on their schedule and their terms. To automate that exchange, the agency needed cloud orchestration that never stored unencrypted payroll data in the cloud and kept the audit copy on servers the agency controlled.

Payroll Files Moved by Hand, Against ADP's Clock

The systems generated the files automatically. Delivery was a staff routine run each cycle. The HCM system dropped its exports into a folder on an internal server, and staff processed the CSV files and delivered them to ADP inside its window.

ADP ingested files inside fixed windows and under strict naming rules. Its automation expected a specific file name, and a file that arrived misnamed dropped into an unprocessed folder on ADP's side instead of into the run. The agency wanted the window, the naming, and the encryption enforced by the workflow itself rather than by procedure.

The workload was also multiplying. HR, leave-of-absence, payroll and benefits feeds each needed the same treatment, four parallel streams on the same cycle. The agency wanted one automated pattern that every feed could follow.

Why the Manual Process Outlived an MFT Platform

The agency was not short of file transfer tooling. The agency ran Axway Secure Transport, a legacy managed file transfer platform, for its vendor data feeds. But a single Axway job took more than four months to implement, and the platform was difficult to support. Building the payroll automation there never happened, because the manual routine was faster than the tool that was supposed to replace it.

What replaced the manual process had to satisfy a constraint the agency's cybersecurity team set from the start: encryption applied as the file moved, with unencrypted payroll data never stored in the cloud. An unencrypted copy had to be archived on the agency's own servers for audit. Delivery had to run over SFTP, inside ADP's windows and under its naming rules. HR staff had to be able to trigger runs themselves, without administrator access to anything. And with protected health information in scope, the platform had to operate under a HIPAA business associate agreement.

The agency selected Files.com to be that encryption-and-delivery layer.

An Encryption and Delivery Layer That Leaves Plaintext at Home

For the payroll workflows, Files.com became the layer between the agency's on-premises HR systems and its outside processors. It handled the pickup, archiving, encryption, delivery and notification, while unencrypted data stayed inside the agency's network.

Files.com On-Premise Agents ran on servers inside the agency's environment with read access to the directory where the HCM system dropped its files. The Agent connected outbound to Files.com, so nothing on the agency's network had to be exposed to reach it.

When a file appeared, a chain of Files.com Automations took over. An unencrypted copy moved into an archive on the agency's side, preserving the audit record on servers the agency controlled. The file was then PGP-encrypted and delivered over SFTP to ADP and the agency's internal Optima ERP. The design rule was simple: apply the PGP and send, so that nothing unencrypted ever sat in the cloud. Deliveries were named to ADP's rules and scheduled against its fixed monthly window, and stakeholders received an email confirming each completed run.

After validating the HR feed as a pilot, the agency extended the same pattern to leave-of-absence, payroll and benefits feeds in a single working session. The agency also kept the least-privilege requirement intact: the HR staff who run deliveries were granted access to just the automations their standard procedure names. They can trigger a run on demand and see its history, and nothing else.

The agency kept the manual process running in parallel until the automated workflow had been validated end to end, then shut it off.

Four Feeds, One Agent, No Hands

With the workflows in production, the agency replaced a hand-run payroll routine with a repeatable, encrypted integration pattern.

• Payroll, HR, benefits and leave-of-absence files reach ADP and Optima with nobody handling them. ADP's fixed monthly window is met by a scheduled automation rather than a manual run, and on the first end-to-end validation, ADP's own automation processed the delivered file immediately.
• Encryption is enforced by the workflow rather than by procedure. Every file leaves PGP-encrypted, unencrypted payroll and health data never leaves the agency's environment, and the audit copy stays on the agency's own servers.
• The pattern compounds. The first workflow went from design session to validated encrypted delivery in about five weeks, and extending it to four parallel feeds took a single working session. Adding the next feed is a folder and an automation, not a months-long integration project.
• HR staff run their own deliveries. Non-admin users trigger exactly the automations their procedure calls for and confirm the outcome from the run history and completion emails, with no ticket to IT.

Cloud Orchestration, With the Data at Home

The lesson in the agency's build is that moving orchestration into the cloud did not mean moving the data there. Files.com runs the scheduling, encryption and delivery from the cloud, while unencrypted payroll data never leaves the servers the agency controls. A public agency got the automation without giving up custody of the data.