Skip to main content

Overview

Files.com serves customers around the world who operate under a wide range of regulatory, contractual, and industry requirements. These include U.S. federal customers evaluating cloud services under FedRAMP, healthcare organizations handling protected health information under HIPAA, financial-services organizations with recordkeeping and operational-resilience obligations, and businesses with privacy responsibilities across multiple jurisdictions.

Many organizations also require independent assurance, such as a SOC 2 Type II report, as part of their vendor reviews.

Those requirements extend across the service our customers use and the company providing it. Information security is one component of compliance, alongside privacy, business continuity, financial assurance, accessibility, corporate governance, and responsible business practices. The requirements relevant to a particular organization depend on its activities, information, relationships, and obligations.

Enterprise Vendor Standards

Our goal is to operate as a model enterprise vendor. We work to adopt best practices across the responsibilities that customers entrust to us, both in the Files.com product and in how we run our own company. That includes protecting information, respecting privacy, maintaining dependable operations, governing employee and supplier relationships, and supporting the contractual and assurance requirements of the organizations we serve.

We want to earn recognition as the most trusted vendor in the file orchestration space.

Our aim is an industry-leading level of transparency: enough specific information for customers to understand our practices, evaluate our commitments, and decide how Files.com fits into their own control environments. That requires clear explanations of scope, conditions, responsibilities, and limitations, as well as the safeguards and capabilities we provide.

Transparency, Assessment, and Independent Assurance

This reference serves three related purposes:

  • Transparent information about Files.com. We describe the product and the way we operate the company, including our controls, policies, business practices, and compliance positions. We distinguish platform protections, optional customer controls, contractual commitments, and the responsibilities retained by customers and other service providers.
  • Support for your own assessment. You can use these disclosures to conduct due diligence, evaluate Files.com against your requirements, and determine how our controls contribute to your own control environment. Public explanations and available supporting documents let you examine the substance behind a claim, identify relevant conditions, and understand where your organization needs its own controls or additional evidence.
  • External assurance. We supplement our disclosures with independent examinations and applicable certification programs. These include the independent SOC 2 Type II examination and our FedRAMP certification. Each program has a defined purpose and scope. Our goal is to expand the breadth of independent assurance through additional types of third-party audits, assessments, and certifications that help customers evaluate and rely on Files.com.

Our descriptions and external assurance serve complementary roles. A report or certification provides evidence about its defined scope; the broader reference helps you understand the service, the company, and the conditions relevant to your use. Document Requests describes the available evidence, access requirements, and disclosure policies.

For technical evaluation of security controls, the Security Reference explains their behavior, interactions, and the consequences of configuration choices. Use it alongside the commitments, responsibilities, and evidence described here. The security configuration guides in Product Documentation explain how to apply customer-controlled settings.

Using This Reference

Files.com is responsible for the controls and practices it operates and for its applicable legal and contractual obligations. Your organization determines which requirements apply to its activities and whether its use of Files.com meets them. The applicable agreements define the contractual commitments for your relationship with Files.com.

You can read this material to learn about Files.com as a company and service provider, or consult individual subjects when a specific question arises. The reference supports initial purchasing decisions, formal vendor due diligence, contract reviews, and renewal assessments.

Existing customers can use it when reviewing an established deployment, introducing a new use of the service, or responding to changes in their own obligations.

The information also supports your organization's ongoing compliance work. You can use it to identify the Files.com controls your processes rely on, document the division of responsibility, and supply relevant explanations and evidence to your auditors. The Shared Responsibility Model explains the relationship between the controls Files.com operates and the configuration and practices your organization manages.

Use Regulatory & Industry Requirements to identify the obligations relevant to your use and the associated agreements and configuration conditions. Use Audits & Assurance to evaluate reports, certifications, and assessment evidence against your review requirements.

Keep material conditions with an answer when using this information in a questionnaire or assessment. A statement about HIPAA support, for example, includes the Enterprise plan, executed BAA, and required security configuration. The supporting report, agreement, or detailed explanation supplies the evidence for that answer.

Security and Compliance Questionnaires

Enterprise prospects and customers can request direct support from our team to complete formal security or compliance questionnaires. Our in-house Legal and Information Security teams review and approve each response.

For additional documentation or a questionnaire request, contact your Account Executive or Customer Support.