Payroll Files To The Provider
Workday delivers the payroll file; an Automation encrypts it under the provider’s own PGP key and hands it to ADP, Paychex, or the bank on their schedule. That step used to be a person with a desktop PGP tool.
The SFTP Endpoint Workday Doesn’t Give You
Workday moves data as files over SFTP: payroll to the provider, benefits to the carriers, new hires to the directory. The other end is yours to provide. Files.com is that endpoint, run as a service. It receives, decrypts, routes, verifies, and audits every feed, and stages the inbound ones for Workday to pick up.
No credit card required · 7-day free trial · Live in minutes
#1 MFT vendor in Gartner Peer Insights
Trusted by 4,000+ companies
Every protocol included
4,000+ organizations rely on Files.com every day
Real companies. Real file flows. Real results.
How Files.com Fits With Workday
Every Workday integration that moves a file needs an SFTP destination. Enterprise Interface Builder (EIB) integrations deliver custom-report output on a schedule; Core Connectors push payroll, benefits, and worker data in vendor formats; Workday Studio assemblies deliver whatever the integration team builds; report-as-a-service feeds write extracts the rest of the business consumes. Workday points all of them at a host, a directory, and a credential. Everything that happens after delivery is somebody else’s problem.
Files.com is the somebody else. The file lands and the platform takes over: PGP decryption as a folder setting, Automations that split and route each feed to the right vendor, monitoring that notices the feed that never came, and an audit trail that turns every payroll-delivery question into a lookup. No server of your own, no scripts, no person babysitting the Monday run.
Files.com carries every payroll and benefits feed a company runs the same way: in from employer clients, out to carriers and processors, and between the HR and finance systems that cannot talk to each other.
The Workday File Flows Teams Actually Run
Payroll, benefits, identity, and vendor intake: the feeds every Workday shop operates, running on Files.com in production.
Benefits And 401(k) Feeds, Fanned Out
One Workday delivery becomes many vendor deliveries: an Automation renames, splits, and routes each feed to the right carrier or record-keeper folder, each partner scoped to its own walled space, with retries instead of pages.
Inbound Vendor Files, Staged For Pickup
EIB runs inbound too. Vendor eligibility files, bank acknowledgements, and demographic data land in Files.com, where they’re decrypted, validated, and staged in the folder Workday retrieves from on its next scheduled run.
Workday To Active Directory And Downstream Systems
New-hire and termination feeds move from Workday to identity and downstream systems through one governed exchange point. The X.509 certificate authentication some Workday integrations require is handled as configuration.
The Feed That Never Arrived
A payroll integration that silently didn’t run is a payroll incident. Delivery monitoring knows when the Workday file was supposed to land and alerts when it doesn’t. The payroll file-watching scripts retire for good.
Every Transfer On The Record
Every delivery, pickup, decryption, and permission change lands in a tamper-proof audit log, so the answer to “did the 401(k) file go out on the 3rd?” is a search, not an investigation.
Litera replaced the person who ferried HR files between Workday and Active Directory with a Files.com exchange point both systems authenticate to, X.509 certificate included, while integrating the employees of 24 acquisitions.
What Workday Needs From The Other End
Your Workday administrator asks for the same things before every feed goes live. Files.com answers each one.
A Stable Endpoint With A Static IP
Workday integrations point at a hostname that never changes and an IP your network team can allowlist, under your own domain if you want it.
The Authentication Workday Expects
Password, SSH key, or X.509 certificate authentication, including the key formats Workday’s Create x509 Private Key Pair task generates.
A Service User Per Integration
Each EIB or Core Connector gets its own credential, scoped to its own folder, so one integration can never read another’s files. Rotating one key touches one feed.
PGP Handled In The Flow
Workday encrypts with the PGP public key you load into the tenant; Files.com holds the private key in its key manager and decrypts on arrival. Outbound, the reverse.
Prove It Before The Next Payroll Run
The evaluation is not a project. The whole loop validates inside the 7-day free trial:
- Start a trial site. It provisions in minutes, with the hostname Workday will deliver to.
- Create a service user jailed to one folder.
- Point one EIB delivery at the new host, directory, and credential.
- Run it. The file lands, decrypts, and routes while you watch.
- Wire the delivery monitor, so the feed that doesn’t arrive alerts you before payroll notices.
That’s the whole cutover, rehearsed on one feed. Every other Workday feed after it is the same three fields.
Customers Running Files.com With Workday
BlueScope Buildings Took Custody of 50,000 Candidate Records on Files.com Before Retiring Click Boarding
Workday could not absorb the archive, so Files.com received, organized, and preserved every record under BlueScope’s governance.
Read The Story
AAA Northeast Routes Workday Payroll and HR Feeds to Banks and Downstream Processors
The migration preserved partner workflows with a hostname-and-credential change while Files.com made encryption, retention, identity, and auditing enforceable.
Read The Story
Procore Replaced Its On-Premises Workday-to-NetSuite Payroll Path With an Auditable Files.com Transfer Layer
Replacing the on-premises endpoint meant moving a live payroll workflow to unattended service accounts while preserving its audit trail.
Read The Story
Moelis & Company Runs Its Workday File Flows on Files.com With GPG Encryption and Scheduled SFTP
Moving the bank’s sensitive production transfers took a flow-by-flow lift-and-shift that preserved its encryption, service accounts, and surrounding integrations.
Read The Story
“Files.com's strengths are simplicity, ease of use, and the cloud connectors. We don't have to invent custom infrastructure for every partner.”
Tommy Chapley
Senior Software Engineer, Equifax
“Files.com is versatile — it can manage many different situations from a single platform. We've consolidated multiple tools onto it.”
Regis Litre
Chief Information Officer, Rag & Bone
“Files.com is robust and scales to a large enterprise. We get multiple files per minute, per second — and we're a 24/7 organization, so everything has to always be up.”
Nelson Miranda
Sr. Systems Engineer, Spirit Airlines
Files.com With Workday FAQ
What Workday administrators ask most when setting up SFTP delivery.
Yes. SFTP is Workday’s standard file-delivery mechanism. Enterprise Interface Builder (EIB) integrations, Core Connectors, Workday Studio assemblies, and report-as-a-service feeds all deliver to, or retrieve from, an SFTP destination on a schedule. Files.com is that destination, run as a service: Workday delivers or picks up, and Files.com handles everything after the handshake.
Workday supports password, SSH key, and X.509 certificate authentication for SFTP delivery. Files.com accepts all three, including the certificate authentication some Workday configurations require.
No. Workday delivers to and retrieves from an external SFTP endpoint that you provide. Files.com is that endpoint as a service: a permanent hostname, a scoped credential per integration, and nothing for your team to host, patch, or keep online.
The EIB delivery step takes a host, a directory path, and a credential. On the Files.com side that credential is a service user jailed to the integration’s own folder, authenticating by password, SSH key, or X.509 certificate. There is no code to write on either side.
Pointing Workday at Files.com takes minutes on each side. The Files.com site provisions in minutes, and the Workday change is an EIB delivery edit: host, directory, credential. The first delivery validates end to end the same day, inside the 7-day free trial.
Yes. You load a PGP public key into the Workday tenant and EIB encrypts each delivery with it. On Files.com, the matching private key lives in the GPG Key Manager and decryption happens automatically on arrival. Outbound files to payroll providers get encrypted under each provider’s own key the same way.
Yes. Workday delivers once; Files.com Automations split, rename, and route the output to each carrier, record-keeper, and bank folder, encrypt per recipient, and retry on failure. Adding a vendor is a folder and a routing rule, not a new integration project.
Files.com raises the alert. Delivery monitoring defines the window each Workday feed is expected in and alerts when a window closes without a file, so a missed payroll file is caught hours before payroll notices. File-triggered systems can’t see absence: a feed that silently didn’t run looks like a quiet day.
Yes. Inbound EIB integrations retrieve from an SFTP source on a schedule. Vendor files land in Files.com, get decrypted and validated, and wait in the pickup folder for Workday’s next run. Every pickup is logged, so you can prove Workday collected the file and when.
Yes. Each integration gets its own service user scoped to its own folder, so dozens of Workday feeds run side by side on one Files.com site. Rotating one credential touches one integration, and the audit trail reads per-feed.
Yes. Files.com copies each delivery to an archive folder automatically, under retention policies you set. The exchange keeps a durable record even when a downstream vendor deletes what it collects, and cleanup runs on your schedule, so employee data doesn’t accumulate indefinitely.
Yes. The endpoint that answers Workday is a full File Orchestration Platform, and it runs the rest of your file exchange on the same site: NetSuite extracts, carrier and bank deliveries, partner pickups, and on-prem handoffs. One audit trail, one place to look when a feed is late.
Put Files.com On The Other End Of Workday
Receive, transform, route, and audit every file moving to and from Workday, with no server of your own to run. The first delivery can validate today.
No credit card required • Free for 7 days • Live in minutes
Keep Exploring
Payroll & Benefits Feeds
Payroll, enrollment, and eligibility files between HR systems, carriers, and processors, encrypted and on schedule.
PGP / GPG Encryption
Encrypt and decrypt files automatically as they move, with managed keys.
File Delivery Monitoring
Define what correct delivery looks like; get alerted when it isn’t.