Files.com maintains a robust, multi-layered approach to identifying and remediating vulnerabilities across its infrastructure, codebase, and cloud environment. Our testing includes both manual third-party penetration testing and automated scanning to proactively identify and resolve risks.

These practices are a key part of our security posture and are reviewed annually as part of our SOC 2 Type II audit.

Third-Party Penetration Testing

Files.com undergoes third-party penetration testing at least once per year. Each annual test includes a full evaluation of:

• The Files.com web application
• Public APIs and SDKs
• Supporting infrastructure

To ensure objectivity and breadth, Files.com is not permitted to use the same penetration testing vendor in two consecutive years.

All penetration testing engagements are scoped to include validation of the OWASP Top 10 vulnerabilities. These include (but are not limited to):

• Injection attacks (e.g., SQL, command, LDAP)
• Session management flaws
• Cross-Site Scripting (XSS)
• Insecure deserialization
• Broken access controls
• Browser security misconfigurations

PenTest Completion Letters

Customers can Download our PenTest Completion Letters for formal confirmation that testing was performed. For additional details, please refer to our SOC 2 report, which is available under NDA.

Files.com Bug Bounty Program

In addition to formal penetration testing, Files.com maintains a Security Bug Bounty Program to support independent security researchers in responsibly disclosing vulnerabilities.

Customers are encouraged to participate or review our program, which has helped us continuously identify and resolve security issues in production.

Automated Vulnerability Scanning

Files.com also conducts regular automated vulnerability scans, which include:

• Monthly scans of all public-facing systems and the internal network
• Daily security posture monitoring through AWS Security Hub, with alerts based on AWS best practices and CVSS (Common Vulnerability Scoring System)
• Automated web application scanning, including specific checks for OWASP Top 10 risks

Any vulnerabilities identified during scanning are prioritized and resolved as quickly as possible via our Patch Management and Change Management processes. Web application vulnerabilities are remediated through our secure development lifecycle practices.