Security and data handling
Your clients' files, protected end to end.
Rosters, eligibility and payroll files run through FileFeed every night. This is how they are handled.
SOC 2 Type II
Controls summary available today.
GDPR
Signed before the first file.
HIPAA
For files that contain PHI.
Data residency
You choose the AWS region.
How files are protected
What your security team will ask
Encrypted in transit and at rest
SFTP and TLS in, AES 256 on AWS, HTTPS and HMAC signed webhooks out.
One client, one lane
Each sender has its own SFTP user, folder or inbox. No client sees another's files.
You decide how long data lives
Retention is yours to set. Deletion on request within one business day.
Every run is on the record
Every file, run, mapping change and delivery is logged with who and when.
Least access, inside and out
Role based access for your team. On our side, two founders, MFA, logged.
Your files are never training data
AI suggests mappings from headers. File contents never train any model.
Who is accountable
Two founders. The only people with access.
In production with nightly rosters from 30+ hospital HR systems for Hellora since 2025, with no security incident.
FAQ
Security questions we get on the first call
Where are our clients' files stored?
On AWS, in the region you choose (US or EU), encrypted at rest with AES 256. Each connection has its own storage path, and files are deleted on the retention schedule you set.
Can we send files that contain SSNs, payroll or health data?
Yes. That is what most of our production feeds carry: employee rosters, eligibility and payroll exports. Sensitive fields can be masked in the dashboard and in logs, and we sign a DPA, and a BAA where PHI is involved, before the first file.
Do you have a SOC 2 report?
SOC 2 Type II is in progress. Until the report is issued we share our controls summary and answer your security questionnaire directly, usually within two business days.
Who at FileFeed can see our data?
Only the two founders, and only to set up or support your feeds. Access requires MFA and is logged. There are no contractors or offshore support teams with production access.
What happens to our data if we stop using FileFeed?
You export your mappings, schemas and run history, and we delete all files and processed output within 30 days, or sooner on request, and confirm in writing.
Can we run a security review before the pilot?
Yes. Send your questionnaire to igor@filefeed.io or bring your security lead to the live feed call. The pilot can start with redacted files while the review runs.