When a major bank, asset manager, or credit bureau says you’ll exchange files PGP-encrypted with these keys on this schedule, Files.com makes that mandate trivial to meet. It encrypts and decrypts automatically inside the workflow you already run, and manages the entire key lifecycle for you. The cipher isn’t the hard part. The key exchange, the rotation, and the setup are. Files.com runs all of it.
PGP, and its open-source successor GPG, is the public-key encryption standard that large organizations require of anyone who exchanges files with them. Usually you’re not a security team shopping for encryption. You’re the company or vendor that has to satisfy a big counterparty’s PGP requirement to keep doing business with them. The mandate arrives, and suddenly it’s your problem to implement, and it has to fit the flow you already run.
Files.com, the File Orchestration Platform, makes it easy on both fronts. The encryption happens automatically inside the transfer, and the genuinely painful part, the key management, is handled too. You meet the contractual requirement without standing up a separate PGP server, distributing private keys to every system that touches the file, or maintaining the GnuPG glue scripts legacy MFT tools force on you.
The mandate lands hardest on payroll and benefits feeds, where a bank or carrier requires every file encrypted with its key before a deadline nobody can move.
“PGP encryption is so seamless to implement. Creating integrations is easy too — especially the AS2 connections.”
Configure it once per folder, and encryption happens on every file automatically, with nobody on your team running a script or touching a key by hand. For one-offs, encrypt or decrypt a single file on demand with no folder setup.
When a file lands in a folder you’ve set up for it, Files.com encrypts it with your partner’s public key, so only they can read it. An inbound file gets decrypted with your private key, so it flows into your downstream systems in plain form. No wrapper scripts, no manual step.
This is the part that actually hurts: generating keys, storing them safely, rotating them on the counterparty’s schedule, and exchanging public keys. The GPG Key Manager runs all of it. You generate or import keys in the UI, attach them to folders or partners, and rotate without touching filesystem scripts or per-machine keyrings.
Set per-folder keys so each partner or workflow has its own encryption boundary, enforced by your folder structure rather than by an external orchestration tool you have to maintain.
GPG Recryption decrypts with one key and re-encrypts with another in a single operation. Use it for partner-to-partner exchange where the inbound and outbound key pairs are different. The file is never left sitting in plaintext between steps, so it stays protected the whole way through.
GPG isn’t a standalone tool. It’s a step inside an automated workflow. Inbound: an encrypted file arrives, GPG decrypts it, and an automation routes the plaintext to your downstream system. Outbound: an automation prepares the file, GPG encrypts it with the partner’s key, and it’s delivered. For partners who layer PGP on top of AS2 and EDI, the two compose in the same flow.
Every GPG operation is logged: the file, the user or automation that started it, the key used, and the timestamp. The per-event record a partner audit asks for already exists, and no one has to assemble it. Tamper detection (MDC) is supported on encrypted payloads. GPG with your own keys is available on Power and above.
The banks, payroll providers and state systems set the mandate. These are the four ways customers meet it without a person holding a passphrase.
A folder rule decrypts every file the bank, carrier or state system drops, using a key held on the platform, and the plaintext lands where the ERP or payroll system reads it. Nobody runs GnuPG at a desk on payday.
The HR or ERP system that cannot handle keys writes its export to a folder, the folder encrypts it with the counterparty’s public key, and the sync delivers it to their server on schedule. The system that cannot encrypt never has to.
Dozens of inbound feeds, each encrypted under its own key, decrypt in their own folders, so a key rotation on one client’s side is one folder’s setting rather than a script edit across the estate.
A partner folder that accepts only PGP-encrypted uploads and notifies the owner when one lands turns a policy into a mechanism, with the private key never leaving the platform.
What teams ask about which protocols it covers, how it differs from at-rest encryption, key management, and pricing.
PGP encryption locks a file with the recipient’s public key so that only the matching private key can open it, and it can sign the file so the recipient can prove who sent it and that nothing changed in transit. It protects the file itself, independent of the connection it travels over, which is why banks, credit bureaus, and healthcare partners mandate it on top of SFTP. What PGP encryption is and how it works covers the mechanics in plain terms.
PGP is the original 1991 program and the name everyone uses for the idea; OpenPGP is the open standard it became; GPG (GNU Privacy Guard) is the free software that implements that standard and the tool most teams actually run. A PGP key and a GPG key are the same kind of key, and a file encrypted with one opens with the other. PGP and GPG keys explained covers the key pair and the two jobs it does.
PGP/GPG encryption on Files.com runs anywhere a file lands in a GPG-enabled folder: uploads over SFTP, FTPS, and HTTPS, the API, share links, Inboxes, and Sync. It is automatic across all of them, configured once per folder, so you do not wire up encryption separately for each transfer method.
PGP/GPG and Files.com’s built-in at-rest encryption are separate layers. Files on Files.com storage are encrypted under our own AES-256 key management, on by default. GPG sits on top of that with your own keys, for end-to-end exchange with a partner. Keys in the GPG Key Manager are encrypted before storage and cannot be accessed by Files.com employees. A file encrypted with only your partner’s public key stays unreadable to everyone but your partner, Files.com included.
PGP key management is the hard part because the operational work takes far longer than the encryption itself, and Files.com runs all of it in the GPG Key Manager. Generating keys, storing them securely, rotating them on your counterparty’s schedule, exchanging public keys, and getting the initial setup right is the headache that drags out onboarding a large counterparty. With the whole lifecycle in one console, the slow part stops being your problem.
Files.com decrypts files that arrive both encrypted and signed, but does not verify the signature on inbound files. On the outbound side, Files.com signs encrypted files with your signing key when a partner requires signed payloads. If your partner requires verified inbound signatures, raise it with our team before you build the workflow.
Files.com bills PGP/GPG encryption, decryption, and recryption through Transformation and AI Credits, not a per-GB step charge. Each plan includes a monthly credit allotment that scales by tier, with overage priced per million credits. GPG with your own keys is available on Power and above, and current credit rates are published on the pricing page.
GPG encryption and decryption run on files arriving through the Files.com Agent from your on-prem folders. In one deployment, Files.com Agents handled PGP decryption cleanly where Axway was silently failing on a small share of inbound encrypted files. A decrypted file appears as a newly created file in the destination, which can then trigger downstream automations.
Attach a PGP behavior to the folder in Files.com and store the private key there. Every file uploaded to that folder over SFTP, FTPS, the browser or the API is decrypted on arrival, and an automation can move the plaintext to the folder your downstream system reads or into your own storage. The encrypted original can be retained or expired by rule.
Point the export at a Files.com folder carrying the bank’s public key. The folder encrypts each file as it lands, and a scheduled sync pushes it to the bank’s SFTP server with the delivery recorded. The ERP or payroll system keeps writing plain files and never touches a key. That is the shape of ACH and positive-pay exchange at most customers.
Yes. Each client’s folder in Files.com carries its own key pair, so a hundred inbound feeds decrypt with a hundred different keys without a script knowing any of them, and rotating one client’s key changes one folder.
Start a 7-day free trial, generate or import your keys in the GPG Key Manager, and turn on automatic encryption for a folder. Onboard to the counterparty without the key-exchange drama.
No credit card required • Free for 7 days • Live in minutes
Payroll, enrollment, and eligibility files between HR systems, carriers, and processors, encrypted and on schedule.
Daily holdings, NAV, and trade files with custodians and fund administrators, on their terms.
A tamper-proof record of every login, file event, and change.