VelocityEHS Kept SharePoint Locked Down by Moving External File Sharing to Files.com

VelocityEHS makes the software that industrial operators run their environment, health, and safety programs on. Its Accelerate platform covers workplace safety, chemical management, industrial hygiene, and sustainability for more than 15,000 customers, including a third of the Fortune Global 1000, and it protects over 10 million workers worldwide. Verdantix has named the company a Leader in EHS software six times.

A company whose product is compliance gets judged by its own security posture. VelocityEHS holds SOC 2 Type II attestation and treats that posture as part of what its customers buy. The posture collides with a fact of the business: the work runs on files exchanged with outsiders. Customers send datasets and documents in during onboarding and in steady state, and documents flow back out to them. Everything crossing the company boundary is exactly the traffic a security team most wants controlled, and it is also the traffic the business can least afford to stop.

A Three-Day Ceiling on Every External Share

To accommodate its security requirements, VelocityEHS restricted external-sharing permissions on SharePoint and OneDrive to a three-day limit. Inside the company, nothing changed. SharePoint kept doing what it does well. Outside the company, the limit changed everything. Three days is shorter than almost any real exchange with a customer, so the tools that had carried external sharing could no longer carry it.

That left the business with a gap where a channel used to be. A lockdown with no sanctioned alternative does not stop files from leaving a company; it stops IT from seeing how they leave. Every legitimate exchange with an outside party now had two options: stall on an expired link, or find a way around the control.

“We’re using Files.com as a replacement for that external sharing.”

The Lockdown Was the Point

The easy fix was to loosen SharePoint back up, and VelocityEHS never considered it. The restriction was not an accident to be undone. It was a deliberate piece of a posture the company expects to keep tightening.

“We see the writing on the wall with compliance and security.”

So the fix had to come from the other direction. VelocityEHS needed a channel any employee could use to send files to, and collect files from, any outside party. Every grant of access had to be temporary by design, with links that expire and accounts that shut themselves off, rather than a slow accumulation of standing outside access. The controls had to be set once by security, not left to each person’s judgment on each share. And every transfer had to land in a record the security team could watch from its own tooling.

VelocityEHS made Files.com that channel: the sanctioned path for sharing documents with anyone outside the organization.

One Governed Channel Across the Company Boundary

Files.com became the boundary of the company, and the boundary was built to be crossed safely rather than rarely.

For sending, employees use Files.com Share Links, with password protection and expiration dates carried on every link. For receiving, Files.com Inboxes collect files from outside parties who need no account and see nothing but their own upload. Customers with an ongoing exchange get their own folder and login, walled off from everyone else’s.

Access ends on its own. Links expire on their dates, and a Files.com user lifecycle rule disables any account that goes 90 days without a login. Every login, upload, and download lands in the audit log, and Files.com audit events stream over the API into the company’s Elastic SIEM, where the security team already watches everything else.

None of this displaced SharePoint from the work it is good at. It stayed the internal collaboration layer, and Files.com syncs inbound files into it, so what arrives at the boundary lands where teams already work.

Security and the Business, No Longer Trading Off

With Files.com carrying the external channel, VelocityEHS replaced a standoff between security policy and customer exchange with a division of labor. The SharePoint and OneDrive lockdown holds without standing between an employee and a customer’s files. Outside access no longer quietly accumulates, and external transfer activity joins the company’s existing security telemetry. VelocityEHS also passed its SOC audits with Files.com in the environment.

Before, every new restriction on SharePoint made a customer exchange harder, and every accommodation for a customer chipped at the posture. Now the two point the same direction: the lockdown holds precisely because legitimate work has a governed place to go.

VelocityEHS never loosened Microsoft 365 to keep files moving. It kept SharePoint for the internal collaboration it was built for, and gave everything that crosses the company boundary a channel on Files.com that was built to be governed.