October 2026

October 2026 adds two public resources for security and compliance reviews: a Security Reference that explains how the platform behaves, and an expanded Compliance reference with assurance documents you can request through the Trust Center. We also shipped security updates to installed Files.com software, so update any installation that doesn't update itself.

Python SDK 2.0 and .NET SDK 2.0 build parallel transfers and checkpoint recovery into the SDK, and a new PowerShell module brings Files.com administration to Windows scripts. Amazon S3 Remote Servers can now write to buckets that require a customer-managed KMS key, and Automations v2 can start a run when a folder is created.

Security Updates for the Agent, Desktop App, CLI App, Mobile App, and MuleSoft Connector

We shipped security updates in October to the Files.com Agent, the Desktop App, the CLI App, the Mobile App, and the Files.com Connector for MuleSoft. If you run any of them, update to the latest version.

The Agent and the Desktop App update themselves by default. If your team turned off automatic updates to manage deployment itself, install the new versions now. The Mobile App updates through the App Store and Google Play, so keep store updates on for the devices you manage.

Install the latest MuleSoft connector from Maven Central, where new connector versions are published before they reach Anypoint Exchange. The connector installation guide shows the dependency to add.

Learn more about Client Software and Security Updates.

Security and Compliance Resources

Security reviews and vendor assessments now have two public references to work from.

Security Reference

The new Security Reference explains how the platform behaves across authentication, administration, access control, encryption, and automation, why we designed it that way, and what each configuration choice means for your site. Administrators, integration developers, and security teams can use it to decide what to run on Files.com, how to configure a site, and how to connect it to other systems.

It is also the specification for independent security testing. If your team or a testing firm plans an assessment of Files.com, give them the Security Reference before they plan tests, and review each finding against it. Testing still requires approval and advance coordination, as described in Planning a Security Assessment.

Compliance Reference and Trust Center

The Compliance reference now goes much deeper on how we operate the company, the commitments we make, the responsibilities that stay with you, and the independent assurance behind each claim. Audits & Assurance matches common review requirements to the evidence that answers them.

The Trust Center carries the assurance documents reviews ask for most, including our SOC 2 Type II report and bridge letter, completed CAIQ, PCI Attestation of Compliance, penetration test completion letters, and VPAT. Browse the catalog without an account and request a document directly from it, instead of asking your account team. Our security team reviews each request, and these documents require a signed NDA.

If you renew vendor assessments or compliance certifications on a regular cycle, start each renewal at the Trust Center. Use Reclaim access to restore access granted for an earlier review. Document Requests explains eligibility and access.

Python and .NET SDK 2.0

Version 2.0 of the Python and .NET SDKs builds parallel transfers, folder jobs, and checkpoint recovery into the SDK, so an integration needs less of its own scheduling and retry code. Both are major upgrades with breaking changes, so review the migration guide before moving an existing integration.

Python SDK 2.0

Python SDK 2.0 sends upload parts in parallel and adjusts concurrency to the connection. upload_directory(), download_directory(), upload_files(), and download_files() move many files under shared limits and report each file's outcome. Each files_sdk.Client keeps its own credentials and settings, so one script can work with several accounts or Workspaces.

A transfer given a checkpoint can resume after an interruption and reuse the work already completed, under the conditions in Pausing and Resuming. download_file() writes to a temporary file first, so a failed download leaves the existing local file in place. Uploads and Directories and Many Files have examples.

Version 2 requires Python 3.11 or newer. Review the migration guide before upgrading an existing integration, and pin Files.com<2 to stay on 1.x until you have.

.NET SDK 2.0

The new client.Transfers methods in .NET SDK 2.0 tune the number of parallel parts to measured throughput, transfer whole folders, report progress, and resume from a checkpoint without resending completed work. DownloadFileAsync puts a file in place only after every byte has arrived and passed validation.

The existing client.RemoteFiles helpers remain available and still send upload parts one at a time, so an integration gets these capabilities by moving to client.Transfers. Version 2.0 supports .NET 10, .NET 8, and .NET Framework 4.8 and 4.8.1; test a .NET Framework application with 2.0 before you deploy the upgrade. Review the migration guide before upgrading.

PowerShell Module for Windows Administrators

FilesCom.PowerShell is a new module that runs Files.com administration as native PowerShell commands. List commands return objects you can filter and pass to the next command, so an access report or a group membership change takes a short pipeline instead of API requests and JSON handling.

The administration and reporting guide covers exporting users, group memberships, and folder permissions to CSV, provisioning users and permissions from a CSV after previewing the changes with -WhatIf, and changing group memberships. Unattended scripts run from Windows Task Scheduler or your job runner, with the API key kept in a secret vault, as described in Automation and Scheduled Jobs.

The module requires PowerShell 7.4 or later on Windows; Windows PowerShell 5.1 isn't supported. Installation explains how to install it from NuGet.org.

Customer-Managed KMS Keys for Amazon S3 Remote Servers

Files.com can now write to Amazon S3 buckets whose policy requires every write to name a specific AWS KMS key. Enter the key's full ARN in the new KMS Key ARN setting on an Amazon S3 Remote Server, and Files.com encrypts the objects it writes with SSE-KMS under that key, through Remote Server Mounts, Syncs, and Direct Routing alike. Key IDs and aliases aren't accepted.

The connection's IAM user or role also needs kms:GenerateDataKey and kms:Decrypt on the key. Changing or clearing the setting affects later writes only; existing objects keep their encryption.

PFX and P12 Certificate Import for AS2

AS2 identities and trading partners now accept a PKCS#12 file (.pfx or .p12) directly, so a certificate that arrived as a PFX file no longer needs converting to PEM first. Choose Import PKCS#12 File (PFX or P12) under Certificate Source and enter the file's password, if it has one.

For your AS2 identity, the file must contain your certificate and its matching private key. For a trading partner, Files.com needs only the public certificate and discards any private key the file includes.

Folder Creation Trigger for Automations v2

Automations v2 can now start a run when a new folder is created, so adding a client folder can kick off an onboarding workflow or email the people who handle it. Choose Folder Creation as the trigger, pick the folder to watch, and set Folder Scope to direct child folders, folders exactly two levels below, or folders at any depth.

Each run receives the new folder's path and name, which a Send Email step can put in its subject and body; Send Email requires Custom SMTP. A new folder doesn't mean its uploads are finished. Copying a folder tree creates an item for every matching subfolder, so choose Direct child folders when only the top-level folder needs a notification.

Subfolder Summaries for Slack and Microsoft Teams

Slack and Microsoft Teams notifications can now post one summary per subfolder instead of one message per file. When a vendor uploads a hundred files into an Inbox submission folder, the channel gets a line such as Uploads/ACME: 10 uploaded, 2 deleted, and each submission's activity stays together.

Set Message delivery to Subfolder summary on a Slack or Teams notification. Each summary sends after a quiet period you choose, from 15 to 300 seconds. A summary reports a burst of activity, so it doesn't confirm that a submission is complete. Existing notifications keep immediate delivery.

Slack and Teams Event Channel targets offer the same summaries for file activity events. A Site Administrator turns those events on from the Settings tab of Event Channels. Review your subscriptions first, because subscriptions with no event types selected begin matching file activity too.

Default Workspace Recipients in Custom Workspaces

Staff who keep their accounts in the Default Workspace can now receive Email Notifications for folders in a Custom Workspace, with no separate accounts created inside it. A Default Workspace user or group becomes an eligible recipient once a Site Administrator grants it a folder permission anywhere in that Workspace.

Workspace Administrators and Folder Admins can choose these recipients for the folders they administer while Share Users and Groups With Workspaces is on, which it is by default. Site Administrators find the setting on the Settings tab under Settings > Workspaces. Turn it off to keep these choices with Site Administrators; existing notifications stay in place.

In the notification form, select Choose specific users and groups not yet subscribed to this folder and pick them from the User or Group list. The All options cover only the Workspace's own users.

Child Site Activity Recorded on Both Sites

When a Parent Site works in a Child Site's folders through _/Sites/, those file actions now appear in both sites' History. The Parent Site records the _/Sites/<child-site-id>/... path, and the Child Site records its own path.

Each site's notifications, webhooks, and Automations respond to its own record, so existing ones on the Child Site now react to matching Parent Site operations. When a Parent Site uploads into a Child Site's intake folder, an Automation on either site can pick up the file. Activity performed directly within the Child Site is still recorded there only. Data and Automations Across Child Sites explains how to set up responses on each site.