Files.com's Information Security Program governs the hosted platform and the company operations supporting it. It connects the obligations we identify, the risks we assess, the controls we operate, and the reviews used to check that those controls remain effective.

The program supports the security and confidentiality of information and dependable service operation. It is one part of our broader compliance approach, alongside privacy, legal and contractual obligations, financial assurance, accessibility, and responsible business practices.

Security Commitments

Files.com acts as an extension of your security team by operating the platform safeguards and company controls your deployment relies on. Our approach combines layered protections, identity and device controls, assigned operating responsibilities, leadership oversight, and transparent explanations of our practices. The platform has operated for over 15 years with zero breaches.

Files.com has never been sued or found at fault for customer damages in connection with an information-security matter. We have never filed or paid an insurance claim related to information security.

Files.com remains responsible for operating our controls and making them function as documented. Your organization determines its intended use, configures the controls it selects, and operates the systems and business processes under its authority. The Shared Responsibility Model connects those responsibilities to specific controls and evidence.

Governance and Oversight

A dedicated Security Team, led by Chief Information Security Officer Sean E. Smith (HCISPP, CISM, CISSP), oversees the program. The team participates in architecture and project planning so that security requirements are considered as systems and services change, as well as during ongoing operation.

Security is a board-level concern. Executive leadership reviews security metrics weekly, including remediation time, patch latency, and penetration-test findings and closure. The program is also reviewed by the board and through the annual SOC 2 examination cycle.

The CISO and General Counsel participate in continuing education to keep their work informed by evolving security, legal, regulatory, and contractual requirements.

Roles and Responsibilities

Program oversight and control operation are related but distinct. Security establishes and reviews requirements, while the teams responsible for systems, personnel, and business processes carry out the work.

Function	Responsibility within the program
Security and Compliance	Maintain the security program and control-review activities, coordinate risk assessment, review security findings, and work with the responsible teams on treatment and remediation.
Engineering and Internal IT	Implement and operate platform and internal-system controls, manage identities and devices, and deliver reviewed changes and remediation.
Legal	Identify and maintain applicable legal, regulatory, and contractual requirements and advise on privacy, information requests, and agreements.
Human Resources and managers	Coordinate personnel screening, onboarding, training, confidentiality obligations, changes in responsibilities, and offboarding. Team leads define role-specific security work.
Executive leadership and the Risk Committee	Review organizational risks, treatment decisions, and program performance, and approve updates within their governance responsibilities.
Employees and internal contractors	Complete required training, protect confidential information, follow the controls applicable to their work, and report concerns through the incident process.

These responsibilities are reflected in written policies, job descriptions, and team procedures. A named control owner and the people carrying out the work make it possible to follow an identified issue through to a decision and corrective action.

Requirements, Policies, and Documentation

Legal maintains the applicable requirements and records their scope, owner, custodian, and review schedule. Employees bring newly identified requirements to Legal. This connects changes in customer agreements and other obligations to the company practices and controls that need to address them.

Our internal documentation includes policies, procedures, standards, and guidelines covering access, assets, development and change management, information handling, incident response, continuity, and supplier oversight. Policies are reviewed at least annually before approval and updated when changes are required. Revisions and approvals are recorded, and changes are communicated internally.

The policy library is proprietary. Document Requests explains standard disclosures, qualifying enterprise reviews, and the separate FedRAMP Certification Package access rules. A public description of a policy does not make the underlying internal document an unrestricted disclosure.

Risk Assessment and Treatment

Files.com's company-wide risk assessment and treatment process connects identified risks to owners, ratings, treatment decisions, and implementation work in a centralized Risk Register maintained by Compliance. Security risks are assessed through that process alongside operational and organizational risks.

Control Reviews and Corrective Work

The program uses recurring reviews as well as continuous operational monitoring. Different controls require different evidence and review cycles:

Personnel access: at least quarterly reviews of active identities, assigned access, and removal of former personnel's access.
Assets: quarterly hardware and software inventory reviews to keep the systems and devices subject to controls accounted for.
System configurations: monthly checks that system settings meet the applicable security configuration standards.
Changes: at least quarterly review of emergency changes and a sample of standard changes for compliance with the change process.
Risk and policies: at least annual formal risk assessment and policy review, with updates when circumstances require them.

Findings are evaluated with the responsible team and tracked through the appropriate treatment, remediation, or change process. Security reviews and prioritizes vulnerabilities; Engineering performs required technical remediation or applies compensating controls. Development and operational security explains that work and the distinction between standard and emergency changes.

An automated alert, an access review, and an independent audit answer different questions. Monitoring supports detection and response; recurring reviews check control operation and records; the SOC 2 examination provides independent assurance over its described scope and period.

Training and Personnel Awareness

Employees and internal contractors complete required onboarding training covering the Information Security Program, acceptable use, remote-work requirements, privacy and information protection, social engineering awareness, incident reporting, and data-breach handling. Annual refresher training is required to reinforce those obligations. Role-specific instruction addresses additional responsibilities, including the training required for Incident Management Team members.

Training and policy obligations continue after onboarding. Managers communicate relevant responsibilities, and changes to procedures are communicated to the people who need to apply them. Employee Lifecycle explains how personnel controls connect hiring, ongoing employment, and departure.

Evidence and Independent Assurance

Files.com undergoes an annual independent SOC 2 Type II examination covering Security, Availability, and Confidentiality. The report describes the system, controls, examination period, and complementary responsibilities; it is not an examination of every customer-configured workflow.

Internal evidence includes policy approvals, risk assessments and treatment records, access reviews, training records, change records, and asset inventories. These records support control operation and examination work. They remain subject to the disclosure rules in Document Requests, rather than being available through customer site logs.

The latest SOC 2 report and management bridge letter are available to eligible customers and qualified prospects under NDA through the Trust Center. Use the report's actual scope and period alongside the public explanations and your organization's own control evidence.