Files.com manages vendor relationships through a formal Vendor Management Program designed to evaluate risk, maintain continuity, and ensure that vendors meet the same security and availability standards we uphold internally. Vendor oversight practices are incorporated into our Risk Management Program and are reviewed annually as part of our SOC 2 Type II audit.

Vendor Risk Management Program

Vendor risk is assessed as part of Files.com’s broader Risk Management Program, which follows the COBIT 5 framework. All vendors are evaluated for potential impacts to the confidentiality, integrity, and availability (CIA) of systems and data. Critical vendors are included in the company’s Risk Register and are subject to annual review.

Files.com maintains a Vendor Risk Management policy that outlines:

• Security documentation review for critical vendors
• Ongoing risk assessments for vendor relationships
• Centralized tracking of vendor risk in the Risk Register
• Integration of vendor oversight into organizational risk treatment

Oversight of Critical Vendors

Files.com does not outsource any key components of its platform to external service providers, with one exception: Amazon Web Services (AWS). AWS is considered a critical vendor and provides hosting for all Files.com infrastructure, including server instances, storage, and databases.

Files.com reviews AWS’s SOC 2 report at least annually. As of the most recent review, no deficiencies were noted. Due to NDA restrictions, we are unable to provide a copy of the AWS SOC 2 report. However, AWS’s security controls are independently audited and documented through their published compliance programs.

Our agreement with AWS requires compliance with the Files.com Privacy Policy and includes contractual obligations around data handling and security practices.

Vendor Continuity Planning

Files.com maintains a contingency plan to replace any critical vendor if necessary. Based on our most recent risk assessment, we do not consider any of our current vendor relationships to represent a material risk. Alternate vendors have been identified and evaluated to ensure continued operations in the event of service disruption or vendor unavailability.

Third-Party Development Partners

The legacy version of the Files.com Desktop App (v4) was developed in collaboration with a third-party vendor. This vendor had no privileged access to the Files.com platform or customer data.

The current version of the Desktop App (v6) is developed and maintained entirely by Files.com employees and is not dependent on any external vendors.

Vendor Onboarding & Access Policies

Files.com does not currently engage contractors or external vendors for internal access roles. However, company policy requires that any future vendors or contractors follow the same onboarding, pre-screening, and access control procedures as full-time employees. This includes background checks, confidentiality agreements, and completion of security awareness training prior to receiving access to any internal systems.

No vendor is granted privileged access to Files.com infrastructure without formal approval and security review.