Files.com manages employee and contractor identity through a proprietary Identity and Access Management (IAM) system built entirely in-house. This system is designed to enforce strong security controls, support organizational scalability, and protect access to internal systems. These controls are reviewed as part of our annual SOC 2 Type II audit.

Proprietary Identity Management System

Files.com does not use third-party identity SaaS providers such as Okta. Instead, we maintain a custom-built IAM platform developed and operated entirely by our internal engineering team. This system provides Single Sign-On (SSO) across all internal applications and is hosted exclusively within our private infrastructure.

Each user is assigned a unique identifier, and password requirements are aligned with the complexity standards outlined in our Information Security Policy. Two-Factor Authentication (2FA) is enforced for all employees using physical, hardware-based tokens to ensure secure access.

Role-Based Access Control (RBAC)

Files.com applies Role-Based Access Control (RBAC) to all internal systems. Access is granted based on the principles of least privilege and need-to-know, with permissions tied to clearly defined roles. These role assignments are reviewed regularly and updated as needed to minimize risk.

Access is promptly revoked upon termination of employment or contract, ensuring that former personnel cannot access internal systems.

Identity Lifecycle & Audit

The Files.com Information Security team conducts formal quarterly audits of all active employee and contractor identities. These reviews confirm that identities and their associated role assignments are accurate, current, and appropriate for each individual’s responsibilities.

The audit process also includes verification that all access for former personnel has been fully deprovisioned. Any discrepancies or anomalies identified are addressed and remediated promptly.

VPN Enforcement of Identity Controls

Access to internal systems is gated through our multi-layer VPN infrastructure, which is tightly integrated with our IAM system. VPN access is disabled immediately upon termination.