GPG Folder Processing

A folder's GPG setting prepares incoming files for the next part of your workflow. Encrypt a report before a partner retrieves it, decrypt a partner's delivery for a consuming application, or recrypt a delivery when the next recipient uses a different key. The folder determines the operation and the keys, so senders do not need to run that processing themselves.

Folder processing does not require an Automation. Files.com administrators enable GPG Encryption, GPG Decryption, or GPG Recryption in a folder's settings. The setting applies to the folder and its subfolders unless it is explicitly disabled in a subfolder. Existing files remain unchanged when you enable it; re-upload them to apply the new setting. Use Manual GPG Encryption and Decryption for a one-time operation on a single file.

Using Folder Processing With Automations

In Automations v1, GPG processing comes from the destination folder's settings, not from an action in the Automation. A Copy Files action can deliver files into the configured folder; a native-storage move does not trigger GPG processing. Keep the transfer configuration and folder rule together when tracing what happens to a delivery.

Automations v2 instead provides explicit Encrypt With GPG and Decrypt With GPG steps. They need no GPG folder setting and pass their result directly to the next node. Use those steps when processing belongs at a particular point in the workflow. The folder settings below remain useful when the receiving location should process incoming files from any source.

Choosing the Operation

All modes have the same 10 GB file-size limit and consume Transformation and AI Credits. Files.com requires unexpired keys for encryption, signing, and decryption, including for content encrypted before a key expired. To recover an old delivery, renew the matching private key; a new, unrelated key pair cannot decrypt it.

Choosing and Preparing Keys

Select existing keys from the GPG Key Manager, or choose Import from file... to provide a key while configuring the folder. Give the imported key a name and enter its private-key passphrase if it has one. Leave the passphrase field blank when the private key has no passphrase.

Choose Create new... to generate a key pair during setup. Enter a name and email address, optionally add a passphrase, then copy the public key and securely download the private key when they are displayed. Generating GPG Keys also covers creating keys in advance and using a GPG tool outside Files.com.

For encryption and recryption output, choose Binary (the default) or ASCII Armor when the receiving system needs text encoding.

Signing the Output

You can sign encrypted or re-encrypted files. Select, import, or create a signing key in the same way as the other keys. Signing requires a private key; public-only keys do not appear in the signing-key list.

Signing output and checking an incoming signature are separate operations. Files.com decrypts signed files but does not verify their signatures, so successful decryption does not authenticate the sender.

Encryption

Select one or more public keys for encryption. A recipient needs only one corresponding private key to decrypt the result. During key rotation, selecting both the old and new public keys lets your counterparty switch private keys without requiring both sides to change at exactly the same time.

Encryption File Name Suffix

The optional Suffix setting appends text to the incoming file's name. The default .gpg turns report.csv into report.csv.gpg.

Use a suffix for automatic encryption. Files that already end with the configured suffix are skipped, which helps prevent an encrypted output from being encrypted again. Do not give an unencrypted input the configured suffix, because Files.com will skip that file too.

With a blank suffix, the encrypted file keeps its original name and could be encrypted more than once. If the output name already exists, Files.com adds a date and time instead of overwriting it.

Decryption

Files.com tries the candidate private keys until one decrypts the file. Only a private key matching a public key used to encrypt the file can recover its contents. A file that cannot be decrypted with the chosen private keys remains unchanged.

Decryption Key Source

Use Any Matching Stored GPG Key lets the folder use private keys in the site's GPG Key Manager. This is the default for new decryption configurations and avoids maintaining a per-folder list when adding or rotating keys. Selecting it requires Site Administrator or Workspace Administrator privileges.

Select Specific GPG Keys restricts processing to one or more keys you choose for the folder. Use it when the folder should decrypt only deliveries encrypted to a known set of keys.

Within a Workspace, either source uses only private keys from that same Workspace.

Decryption File Name Suffix

The optional Suffix setting controls output naming, not which files are submitted for decryption. Every incoming file within the setting's scope is submitted, whether or not its name ends with the suffix.

After decryption, Files.com removes the configured suffix when it matches the end of the filename, regardless of capitalization. The default .gpg turns report.csv.gpg into report.csv. If the filename does not end with the suffix, or the suffix is blank, the original name is retained. If the resulting name already exists, Files.com adds a date and time instead of overwriting it.

The file extension limit checks the incoming name before decryption. It does not check the extension left after removing the suffix. A folder allowing only .gpg uploads can therefore accept report.csv.gpg and store report.csv after decryption. Configure the limit for the encrypted filenames your senders use.

Recryption

GPG recryption, also called re-encryption or re-keying, decrypts an incoming file and immediately encrypts it using different keys. Select the private key for decryption and one or more public keys for the output recipients. You can also select a private key to sign the output.

Files.com decrypts and re-encrypts entirely within temporary system memory. The unencrypted content exists only for the operation, is never written to disk, does not persist in memory after processing, and is never accessible to Files.com employees or any other party.

If the chosen private key cannot decrypt the input, the file remains unchanged. Both the input and output keys must be unexpired. Renew the original private key if it has expired and you still need to process files encrypted to it.

Recryption differs from connecting a v2 Decrypt With GPG node to an Encrypt With GPG node. The two nodes write a decrypted intermediate file before producing the encrypted output. Use folder recryption when the requirement is to change encryption keys without writing the clear content to disk.

A filename extension restriction can require .pgp or .gpg names for incoming deliveries. It checks names only; it does not verify encryption or prevent unencrypted contents with an allowed extension from arriving.

Decryption Integrity Checks

Decryption and recryption offer Ignore MDC integrity check for deliveries without a modification detection code. Enable it only as a deliberate compatibility choice for a trusted source: processing then proceeds without that file-content integrity check. Troubleshooting GPG explains the errors, tradeoff, and counterparty options.

When Processing Runs

Uploads and copies into a folder trigger GPG processing after the complete file arrives. Copies made manually, by an Automation, or by a Sync follow the same rule. A Sync transferring files into the folder triggers processing as an upload would.

Moving or renaming a file in native Files.com storage relocates the existing file and does not trigger encryption or decryption. This applies to manual and automated moves. A move into a Remote Server Mount follows the destination mount's GPG processing instead.

During processing, the incoming file is locked and quarantined. It may appear in FTP, SFTP, or other interface listings, but it is unavailable for actions other than deletion until processing finishes. Files.com streams it through GPG as the output is written to the destination folder; afterward the original is deleted and purged.

The output appears as a newly uploaded file and can trigger Automations that run when files are created. Email notifications, Slack notifications, and Webhooks fire on that output. Automatic encryption and decryption never overwrite an existing output: a date and time is appended to make a conflicting name unique. This differs from the explicit overwrite choice for one-time GPG operations.

Complete and Partial Files

Senders must upload complete files. Encryption can succeed on incomplete content, producing an encrypted file that decrypts back to the same partial input. An incomplete encrypted file fails decryption. A successful encryption operation therefore does not establish that the sender delivered all the expected data.

GPG on Remote Server Mounts

A Remote Server Mount with GPG processing uses buffered uploading. Files.com temporarily stores the complete file in Native Storage, encrypted at rest with its standard storage encryption, applies the GPG operation, then forwards the result to the remote server. The complete file is required for processing.

This applies to uploads, copies, moves, and Syncs into the mount. It also applies when the destination is reached through a Child Site or Connected Site folder at _/Sites/<site-id> or a Partner Channel Route Path. Those access paths do not bypass the mount's GPG rules.

Buffering is required even when the Remote Server's Buffered Upload setting is Never; the override is not reflected in that Remote Server setting. Consider this temporary storage before enabling GPG if your reason for using a mount is to keep file data off Files.com infrastructure.

Monitoring Processing Results

GPG encryption and decryption jobs produce Pending Work events in Event Channels. Subscribe to receive success, failure, partial-failure, and skipped outcomes.

Processing errors also appear in site alert emails sent to Site Administrators who opt in. Use Troubleshooting GPG to distinguish key-import errors, expired keys, size limits, and decryption integrity errors.