Files.com is critical infrastructure for thousands of customers. Customers should be able to understand and evaluate the systems they trust with their most important files and workflows.

We created this Security Reference book to make the product's security behavior transparent, so administrators, integration developers, and security teams can make informed decisions about what they use Files.com for, how they configure their site, and how they integrate it with other systems. The book explains the benefits, tradeoffs, and limits of different approaches to authentication, administration, encryption, and other controls.

We set a high bar for transparency. Our Compliance book describes company practices, service commitments, shared responsibility, independent assurance, and access to supporting evidence. This Security Reference explains the platform's security behavior, the reasons behind our design decisions, and the consequences of different configuration choices.

We go well beyond general assurances: we give your team the information needed to evaluate how the product actually protects your data and access.

Files.com offers many ways to configure a site and combine authentication, administration, access control, encryption, and automation. A choice that fits one part of a workflow can have consequences elsewhere. Your implementation team needs a deep understanding of these relationships to choose controls that meet your requirements and understand what each configuration permits.

Publishing this detail is a commitment. We consider the behavior described here secure within its stated permissions, controls, and configuration requirements, and we expect the platform to honor those boundaries. We are proud to make those expectations explicit so you can evaluate our reasoning and hold us accountable to what we publish.

Configuration Choices

If you want an application to upload files into one folder and have an Automation deliver them elsewhere, restricting the application's access to that folder does not define the full limits of the exchange. The API key's scope governs the application's direct requests.

The Automation runs with its owner's permissions, and the remote connection uses credentials accepted by the destination.

Choose the Automation's owner and destination credentials for the work the process should be able to perform, and review who may change them.

When that exchange needs to stop, choose controls that end the access you intend to remove. Disabling creation of new API keys does not revoke keys already issued.

Removing source-folder access does not recall files already delivered to another system. Access Revocation explains the different controls for credentials, sessions, shared access, and work already authorized.

The security configuration guides and the product guides linked throughout this reference explain where to apply the controls. If observed behavior differs from the documented contract, contact Support.

Planning a Security Assessment

Many of our customers want to perform their own independent security assessments of Files.com. We welcome and encourage that work, whether it is carried out by your internal security team or an independent firm.

Testing against the Files.com service requires approval and advance coordination under the Customer Security Assessments policy. Contact your account representative or Support through that policy's process before testing.

Your security assessors and testers must read this entire Security Reference book before planning or performing tests. Give the book to your testing vendor and use it as the specification for the product's intended security behavior. Plan tests around that specification, the agreed scope, and the actual configuration of the site being assessed.

Review every finding against this reference as part of determining its validity. If a result differs from the documented behavior, explain the expected behavior and the observed result.

If the concern is with a documented design choice, explain its security consequence. The assessment quality guidance explains how to apply that standard when selecting a vendor and preparing findings.

Files.com publishes each month's new capabilities in What's New, with links to the documentation for each one. When you assess Files.com on a recurring schedule, use What's New to find the behavior added since your last assessment, and read its documentation before you plan tests of it.

The source code for the Files.com CLI, the SDKs and connectors, the Files.com MCP Server, and the Terraform Provider is public in the Files.com GitHub organization. Your assessment can include a review of that code alongside testing of the service.

Independent security researchers can test Files.com through the Security Bug Bounty Program on HackerOne, which sets its own scope and testing rules. Report a Files.com credential found exposed in a public source, including those repositories, through the same program. Its policy defines the one check a researcher may make before reporting it.