Skip to main content

Network Security

Files.com protects its infrastructure with a layered security model that combines firewalls, network segmentation, intrusion detection and prevention, controlled outbound connectivity, and malware protection. These systems are reviewed annually as part of our SOC 2 Type II audit and are continuously monitored.

Firewalls and Network Segmentation

All Files.com servers are protected by firewalls configured in a default-deny posture. Only required ports are exposed to the public internet.

Internal systems are segmented into isolated zones using AWS Security Groups, AWS Virtual Private Cloud (VPC), and Terraform-based infrastructure-as-code. This segmentation limits lateral movement between zones.

Intrusion Detection and Prevention

Files.com runs Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) across its environment. These systems monitor for suspicious activity and enforce automated rules to mitigate threats.

Technologies used include:

  • AWS GuardDuty, which detects abnormal behaviors across AWS resources.
  • ModSecurity, a Web Application Firewall (WAF) that protects against common web exploits.

Brute Force Protection

Files.com monitors and rate-limits suspicious login attempts to block brute force attacks. This protection is built into our broader intrusion detection systems through AWS GuardDuty and ModSecurity.

Outbound Connectivity Controls

Most internal systems are restricted from making outbound internet connections. The exceptions are systems that:

  • Sync with third-party storage providers
  • Mount remote storage
  • Initiate file transfers over the internet

Wherever possible, outbound connections are routed through proxy servers so they can be monitored.

Customer Connectivity and Responsibility

Files.com does not initiate outbound connections to customer systems unless explicitly configured by the customer.

Customers may choose to enable features like:

  • LDAP or SSO integrations
  • Remote sync and mount connections
  • Webhooks

Configuration of these features is the responsibility of the customer. For more information, see the Files.com Shared Responsibility Model.

Malware Protection

Files stored within Files.com are not scanned for malware by default. A Site Administrator can turn on Malware Scanning for a folder, which inspects new uploads to that folder and quarantines any file where it finds a threat. It does not scan files already stored in the folder, and customers remain responsible for their own end-user file scanning controls.

Separately from anything a customer turns on, Files.com protects its own infrastructure:

  • Servers are monitored using AWS GuardDuty with malware detection enabled. This monitors Files.com's own systems and is not the same as the per-folder scanning described above.
  • Company laptops are protected with CrowdStrike Falcon endpoint security software.
  • All internal servers run Wazuh agents for File Integrity Monitoring (FIM), which scan for unauthorized software or configuration changes and report findings to a central monitoring system.

Email Scanning and Security

Files.com does not scan emails sent from the platform for malware, spam, or sensitive content. Customers are responsible for ensuring appropriate safeguards when using email-based features.