Files.com maintains a comprehensive Information Security Program (InfoSec) that governs both our platform and internal company operations. The program is built on the SSAE-18 SOC 2 Trust Services Criteria and the COBIT 5 Framework, and is reviewed continuously to ensure alignment with evolving security and compliance requirements.

We have successfully completed multiple SOC 2 Type II audits with independent auditor KirkpatrickPrice. The latest report is available to customers and qualified prospects under NDA.

Core Objectives

Our InfoSec Program is designed to support:

• Business objectives and operational integrity
• Security requirements, including identity and access management (IAM), encryption, and continuous monitoring
• Regulatory and compliance obligations across multiple jurisdictions

Governance & Oversight

The program is reviewed as part of our annual SOC 2 audit cycle.

A dedicated Security Team, led by Chief Information Security Officer Sean E. Smith (HCISPP, CISM, CISSP), oversees the program.

Our CISO and General Counsel regularly attend continuing education programs to ensure legal, regulatory, and contractual obligations are met and continuously updated.

Roles & Responsibilities

Security roles and responsibilities are clearly defined and assigned across the company.

The Security Team collaborates with stakeholders across engineering, operations, and customer support to maintain program integrity.

The Security Team is involved in all major architectural reviews and project planning efforts.

Internal Security Policies and Documentation

Files.com maintains a robust library of internal security documentation, including policies, procedures, standards, and guidelines that govern our operations. While this documentation is proprietary and not shared externally, it is reviewed annually and audited as part of our SOC 2 compliance process.

Key coverage areas include:

• Access and identity management
• Asset and inventory control
• Business continuity and disaster recovery
• Change management
• Data classification, retention, and encryption
• Incident response and vulnerability management
• Risk management and third-party oversight

All documents are updated immediately when changes are required and are communicated internally as part of our governance cycle.

Training

All employees and contractors complete mandatory onboarding training covering:

• The Information Security Program
• Acceptable Use Policy
• Work From Home Policy
• Privacy and Data Protection
• Data Breach
• Social Engineering

Annual refresher training is required for all staff, and role-specific security training is provided as needed.

Asset Inventory Review

Files.com maintains a semi-annual asset inventory review as part of our Risk Management Program.

Customer Access to Security Information

Proprietary internal security documentation is not shared externally.

Customers may request our most recent SOC 2 Type II report under NDA.