Files.com encrypts customer data both in transit and at rest using modern, industry-standard protocols. This article describes our encryption methods, key management practices, and customer options for added encryption controls. These systems are reviewed annually as part of our SOC 2 Type II audit.

Encryption in Transit

Files.com uses secure protocols to encrypt all data in transit across all connection types:

• Web (HTTPS): All web access is protected by HTTPS with TLS encryption. Insecure HTTP requests are automatically redirected to HTTPS.
• FTP/SFTP:
  • FTP over port 990 requires 2048-bit SSL encryption.
  • FTP over port 21 also supports 2048-bit SSL encryption and requires it by default. Customers can optionally allow insecure FTP.
  • SFTP connections use modern SSH encryption.
• API and Webhooks: All inbound and outbound API traffic is encrypted using HTTPS with TLS.

Encryption at Rest

All customer file contents, including backups, are encrypted at rest using AES-256 encryption.

Additional sensitive configuration data is also encrypted using AES-256 with randomly generated initialization vectors. This includes:

• Cloud storage credentials (e.g., AWS S3, Azure Blob, Google Cloud Storage)
• SMTP credentials
• Active Directory / LDAP credentials
• SSL certificate private keys
• PGP/GPG private keys

Custom Encryption Options

Customers on Power, Premier, and Enterprise plans may optionally apply customer-supplied GPG encryption keys to specific folders. This provides an extra layer of encryption that is fully controlled by the customer.

SSL Certificate Management

Customers using a custom domain may request a free SSL certificate from Files.com or provide their own certificate from a trusted provider.

Encryption Key Management

Files.com uses HashiCorp Vault to manage encryption keys and secrets internally. For encryption at rest, key management and escrow are handled using AWS-native services.