Agent Security
The Files.com On-Premise Agent integrates on-premise networks with the Files.com platform. Because the agent runs inside your corporate network, security design is central to how it works. The Agent initiates an encrypted outbound connection and enforces the access settings configured on its host.
Security Record
Files.com conducts annual independent security assessments to identify and address potential risks.
The On-Premise Agent is also included in ongoing independent assessments of Files.com's systems. Files.com reviews reported concerns and addresses confirmed issues.
Strict Access Controls
The agent enforces root folder path restrictions that you configure locally in a file you create and manage on the host. This configuration file cannot be modified or overridden by the Files.com cloud system.
The root setting limits ordinary file access. Enabling Follow Links can expose linked locations, and Agent routing enables connections to configured remote services. Review these options together with the host service account's permissions.
No Open Ports, Encrypted Connectivity
Unlike FTP servers, the On-Premise Agent does not open any ports on your machine. Connectivity runs through an encrypted tunnel that the agent initiates as an outbound connection to Files.com's network. The agent uses public key cryptography to verify that it is connecting to the correct Files.com services.
Enabling the optional Direct Transfers feature is the one exception, adding an inbound listener for faster transfers with the Files.com CLI App and Desktop App. The listener is encrypted, accepts only uploads and downloads that Files.com has already authorized with a signed, expiring authorization, and grants no new access to the Agent's files.
Once the tunnel is established, only Files.com's production services responsible for real-time file access and automation tasks are permitted to communicate with the agent. Those production services are isolated from other environments at Files.com, including staging systems and employee workstations.
Files.com Controls All Access To Your Agent
Files.com authenticates the user and checks their permissions before authorizing an upload or download on the Agent. In the standard configuration, file data is then relayed through Files.com's cloud infrastructure, which acts as a proxy.
Only Files.com has direct access to the encrypted tunnel to your agent, so your internal systems are never directly exposed to external users. FTP servers, by contrast, allow external clients to observe information about your network and servers.
When Direct Transfers are enabled, the Files.com CLI App and Desktop App transmit file data over a direct encrypted connection instead. The Agent requires a valid, unexpired signed transfer authorization for the operation and path. Anyone holding the complete transfer URL can present it until it expires; it is not restricted to the person or network address that requested it. The Agent's Direct Transfer allow and block lists separately control which network addresses can connect.
Dual Logging
The On-Premise Agent writes two log streams. Operations are logged locally on the machine hosting the agent, and they are also logged to Files.com's cloud log infrastructure. The cloud logs can be forwarded to a SIEM (Security Information and Event Management) platform of your choice through our SIEM integration.
The local log file can be ingested into any logging or SIEM system you prefer, the same way you would manage any other local log file. This dual logging approach keeps all activity documented and available for review.