Why self-hosted file sharing for manufacturing starts with engineering data and suppliers
Manufacturers move engineering data and quality records across plants and external suppliers every day, and that exchange is the real requirement behind any self-hosted file sharing decision. Drawings, CAD assemblies, inspection reports and certificates of conformance travel between design engineering, plant floors and dozens of suppliers, often with different identities, devices and contract terms. A generic sync tool built for a single office does not account for that. The questions that matter are who a supplier can see once invited, whether a file can be downloaded from an unmanaged network, how large a multi-gigabyte CAD assembly can be synced without stalling, and whether the company can show where its design data lives.
Several factors separate manufacturing from ordinary file sync. Supplier guests need per-partner access that can be scoped to a folder, expired and revoked without touching internal accounts. Large CAD files stress sync clients, chunking and storage back ends, so the team should test real assembly sizes early. Some plants sit next to operational technology, and the ISA/IEC 62443 series is the usual reference for how industrial zones should be separated from business networks. Exposure is also rising: NIS2 Annex II lists manufacturing as a critical sector, and the Cyber Resilience Act's Article 14 reporting duties for manufacturers have applied since 11 September 2026. Confirm with counsel which of your entities fall within these regimes before designing the retention and incident evidence the file platform must produce.
The short answer is that Nextcloud fits most manufacturing cases, because it combines guest accounts, group and network-based access control rules, an antivirus integration for inbound files and an admin audit log in one platform. Seafile is a strong alternative when sync throughput on very large libraries matters more than the broader feature set and editing needs are modest. The choice should be driven by two questions: how external suppliers authenticate and what they must do with files, and whether engineers need browser-based collaborative editing of documents. Write those answers down before comparing products, then test both candidates with your largest CAD libraries and a real supplier onboarding flow.
Which requirements shape a manufacturing file sharing build
This table maps each regulatory or security requirement that touches manufacturing file exchange to its source and to the concrete build decision it drives. Read each row as a question to answer in your design: which requirement applies to your organization, and what the platform must record, restrict or encrypt as a result. Applicability depends on your entities, products and jurisdictions, so confirm scope with counsel before you treat any row as an obligation.
| Requirement | What it asks for | What it means for the build |
|---|---|---|
| NIS2 Annex II manufacturing scope | Lists manufacturing as a critical sector, covering NACE Rev. 2 divisions 26 to 30 and medical and in vitro diagnostic devices | Confirm whether your entities fall in scope; if so, treat file platform logging and incident evidence as part of your reporting readiness |
| NIS2 incident reporting timelines | Significant incidents require an early warning within 24 hours, a notification within 72 hours and a final report within one month | Enable audit logs that show who accessed or shared which files and when, and keep them retrievable within those windows |
| CRA Article 14 reporting | Manufacturers of products with digital elements report actively exploited vulnerabilities and severe incidents; these obligations apply from 11 September 2026 | If you build connected products, your engineering file exchange with suppliers falls within your vulnerability handling; restrict access to firmware and source artifacts by group |
| Machinery Regulation connected-device requirement | Machinery must be protected so connecting another or remote device does not create a hazardous situation, applying from 14 January 2027 | Keep controlled sharing of machine software and configuration files separate from general supplier access; confirm the requirement with your machinery compliance lead |
| ISA/IEC 62443 zones and conduits | Defines zones of shared security needs and conduits controlling traffic between them, with system and component requirements in the series | Place the file platform in a defined zone; allow only named conduits from plant and supplier networks, and deny sharing paths from operational networks by default |
| Supplier access controls | Limit external parties to the files and actions they need, with traceable identities | Use per-supplier guest accounts scoped to specific folders, with expiring shares and no browsing of other suppliers' content |
| Network-based access rules | Restrict access by source network, group and device context | Configure Nextcloud access control rules so sensitive drawings and quality records are reachable only from approved networks or groups |
| Antivirus on inbound files | Inspect files entering from suppliers before engineers or plants open them | Enable the Nextcloud Antivirus for files app with ClamAV, Kaspersky Scan Engine or an ICAP scanner, and confirm scan coverage for uploads and background scans |
| Encryption and key control | Protect engineering data in transit and at rest on infrastructure you control | Decide between server-side and end-to-end encryption per folder; confirm which search, web editing and recovery features each choice affects |
What engineering and quality data moves through the platform
CAD models and drawings are the most sensitive engineering data a manufacturer shares. Engineering creates them in a CAD or PLM tool, and suppliers consume them for quoting, tooling and production. Files range from small PDF drawings to large assembly packages, so the platform must handle big uploads and sync reliably over slow supplier connections. Versioning matters more than volume: a supplier must know which revision of a drawing governs an order. The PLM system is usually the source of record for released revisions, while the file share holds working copies and supplier-facing packages. Confirm whether the PLM vendor already publishes supplier portals and whether a file share should mirror released data or only receive exports.
- Upload size and sync: Ask the team for the largest assembly package and the slowest supplier link, then test sync and resume behavior with those files before rollout.
- Revision control: Decide whether revisions are encoded in folder names, metadata or only in the PLM, and make sure file versioning settings keep prior revisions retrievable.
- Who creates and who consumes: Engineering publishes, purchasing and suppliers download, and suppliers rarely need to upload anything except marked-up returns.
- System of record: The PLM or document control system should own released status, so the share is not treated as the authority on which revision is current.
- External mounts: Nextcloud external storage can mount an existing engineering share, but confirm with the team whether the mount must be read-only and which permissions it inherits.
Check whether your PLM vendor has an official integration path before assuming a file share can sync released data directly.
Quality records include inspection reports, first article inspection results, certificates of conformance and nonconformance reports. Quality engineers create them, usually in a QMS or inspection system, and plant managers, customers and auditors consume them. These files are typically smaller than CAD packages but far more sensitive to change. A report that is edited after approval is a compliance problem, not just a version conflict. Records should be stored as approved, immutable documents, with the QMS or MES holding the authoritative status and the share providing controlled distribution to plants.
- Approved versus working copies: Separate draft folders from released folders, and restrict write access to released folders so that approved reports cannot be silently replaced.
- Retention periods: Confirm the retention period for each record type with the quality function and the customer contract, since these periods vary by product and customer.
- Source of record: Identify whether the QMS, MES or the inspection instrument software creates the authoritative copy, and whether the share receives a copy or a link.
- Plant access: Plants usually need read access to their own lines and products, which argues for group-based rules that map to plant organization rather than a single shared folder.
- Audit evidence: Keep activity logs on record access and changes, and confirm with the compliance lead what regulators or customers may ask to see.
Ask the quality lead which record types carry customer or regulatory retention obligations before deciding what the share is allowed to hold as the final copy.
Supplier onboarding files include quality manuals, process certifications, insurance certificates, material declarations, audit reports and bank details for payment setup. Procurement and supplier quality create the requests, while suppliers upload documents and internal teams review them. File sizes are usually modest, but the volume of individual submissions can be high, and the data often includes personal and financial information. Versioning here means expiring documents: a certificate valid for one year must be replaced on schedule, and reviewers need to see the current document and its expiry date.
- Guest upload folders: Give each supplier a separate upload area so one supplier cannot see another's submissions, and confirm the guest access model with your identity team.
- Expiry tracking: Certificates and insurance documents need a review date. Confirm whether this lives in the file share, the ERP supplier master or a supplier management tool.
- Sensitive fields: Bank and tax data usually belongs in the ERP or payment system, not in a general share. Ask finance which fields may appear in documents at all.
- Antivirus on inbound files: Every supplier upload is an external input, so scanning on upload should be part of the baseline design.
- Source of record: The ERP supplier master usually holds approved status, while the share holds the submitted documents.
Confirm with procurement and finance which onboarding data is permitted in the file share before setting up any guest folders.
Which open-source platforms fit manufacturing file sharing and why
Manufacturers exchanging drawings, CAD files and quality records need a platform that handles supplier guest access, network-based rules and malware checks on inbound files. The options below differ mainly in their feature depth, licensing and how much of the stack your team will operate, so the fit depends on those conditions rather than on a single winner.
Nextcloud Server for supplier exchange
Nextcloud Server is licensed under AGPL-3.0 and is the option most often chosen when suppliers need guest access to specific folders. Its file access control rules can restrict downloads or access by network, group or user, which helps separate plant engineering from external partners. Check whether your supplier portal workflows, sync clients and external sharing policy can be expressed as rules before committing to the design.
Antivirus on inbound supplier files
The Nextcloud Antivirus for files app scans uploads and runs a background scan of stored files, deleting infected files and notifying users. It works with ClamAV, Kaspersky Scan Engine or an ICAP-compatible scanner, so you can align the engine with the scanner your security team already runs. Confirm the scanner signature update path, because a plant or air-gapped site may not reach the internet for updates.
Audit trail and encryption options
Nextcloud documents an optional admin_audit log and both server-side and end-to-end encryption. For quality records that may fall under customer or regulatory audits, the audit log supports evidence of who opened or changed a file. End-to-end encryption protects engineering data from administrators, but it limits search, web editing and recovery, so decide per folder which trade-off applies.
LDAP, SAML and OpenID Connect login
Nextcloud's LDAP app lets Active Directory users sign in with directory credentials, and Nextcloud also documents OpenID Connect and SAML authentication backends. Supplier accounts often sit outside the corporate directory, so plan separate identity sources or a federation layer for external users. Check that group membership from your directory maps cleanly to the access rules you intend to enforce.
Nextcloud Enterprise as a paid option
Nextcloud GmbH sells Nextcloud Enterprise alongside the community version, aimed at enterprise and public sector users. Its tiers differ in maintenance lifecycle and support hours, and the offering has a 100-user minimum. Manufacturers with multiple plants should compare the support response expectations against their production uptime needs, and ask for the tier that matches the upgrade cadence they can actually run.
Seafile for simpler library sync
Seafile server is released under GPLv2 with an additional permission to link with OpenSSL. It is a fit when the requirement is mainly library-based sync and sharing for plant users, with fewer collaboration features needed. Confirm that its access control, external sharing and antivirus integration meet your supplier rules, and that your team can support its licensing terms alongside any other components.
Nextcloud All-in-One for installation
Nextcloud All-in-One is described as the official Nextcloud installation method. It bundles Redis and APCu caching, PostgreSQL, optional Nextcloud Office, Talk, BorgBackup-based backups, ClamAV and full-text search, with a Helm chart for Kubernetes. It shortens the first build, but your team still owns hardening, network placement and restore testing in the plant environment.
Pairing with an editing layer
Engineers often want to review spreadsheets and documents in the browser instead of downloading them. ONLYOFFICE Docs (AGPL-3.0) or Collabora Online (MPL 2.0) can be paired with file sharing for this purpose. Confirm which formats your suppliers use, how the editor reaches the file store, and whether drawings and CAD files need viewers rather than editors. See the document editing hub for the design trade-offs.
How access rules by network and group keep supplier traffic out of plant systems
The core design decision for this section is that supplier traffic should reach a file platform placed outside the operational technology (OT) zones, and nothing in the file platform should give a supplier a route toward plant systems. A self-hosted file platform belongs in the business or DMZ-facing network, with supplier guest accounts scoped to shared folders only. Engineering teams should treat the platform as a conduit for drawings, CAD files and quality records, not as a bridge into machine networks. Confirm the zone and conduit model with your OT team before any supplier onboarding, because the ISA/IEC 62443 series describes zones and conduits in general terms, and the exact boundaries depend on your plant architecture.
Within the platform, Nextcloud's file access control rules let administrators restrict access by network range and by group. A typical pattern is to allow full sync and download only from managed corporate networks, limit supplier groups to browser access with downloads and sharing disabled, and block sharing from untrusted networks altogether. Confirm each rule against the current Nextcloud administration manual for your release, since rule syntax and available conditions change between versions. Pair these rules with the Nextcloud Antivirus for files app, which scans uploads and runs background scans, deletes infected files and notifies users. Supported engines include ClamAV, Kaspersky Scan Engine and ICAP-compatible scanners, so the scanner choice should be made with your security team and checked for update delivery in an air-gapped or restricted network.
ISA/IEC 62443 also frames a useful question for the supplier relationship: which party owns which security level. ANSI/ISA-62443-2-1-2024 addresses program requirements for asset owners, while ANSI/ISA-62443-3-2-2020 covers risk assessment for system design. Ask your OT team to document where the file platform sits in the zone model, which firewall rules allow traffic from it, and whether any plant engineering system pulls files from it. Then test the boundary: attempt to reach plant subnets from a supplier guest session and from a corporate laptop, and record the results as evidence for your risk assessment. Any path you cannot explain is a finding to resolve before supplier access goes live.
How a manufacturing file sharing rollout moves from supplier pilot to plant-wide use
The sequence starts with an inventory of data and suppliers, then tests guest access and antivirus with a few partners before plants move over. Each phase closes with a named artifact that the next phase depends on.
Inventory data flows and supplier relationships
The team lists which drawings, CAD files, quality records and inspection reports move between plants and suppliers, where they live today (file servers, email attachments, consumer cloud drives or supplier portals), and who needs each one. Engineering, quality and procurement leads confirm the list with the plant managers who own the data. The phase is complete when the team holds a data flow register and a supplier register that names each external party, the files it exchanges and the people who sponsor the relationship.
Assess risk and map zones
Using the data flow register, the team classifies engineering data by sensitivity and by the operational impact of loss or tampering. Where production networks or industrial control systems are involved, the team consults the ISA/IEC 62443 series and NIST SP 800-82 Rev. 3 to decide which assets sit in which zone and what may cross between zones. Obligations such as NIS2 reporting and the Cyber Resilience Act should be checked with counsel for each jurisdiction. The output is a zone and conduit map showing which network segments may reach the file platform and which may not.
Define the identity and guest model
The team decides which users are employees, which are plant accounts and which are supplier guests, and how each group authenticates. Directory integration through LDAP or Active Directory, or through OpenID Connect or SAML, is confirmed for internal staff, while external guests are created per supplier with access limited to named folders. The team also records how guest accounts are approved, reviewed and removed when a supplier contract ends. The artifact is an identity matrix that lists each group, its authentication method, its folder scope and its owner.
Run a pilot with a few suppliers
The team selects a small number of suppliers with different technical maturity and onboards only their guest accounts and one agreed project folder each. Suppliers test upload, download, sync and expiring share links on their own equipment, and the team records which file types, sizes and workflows cause friction. Feedback is logged against the identity matrix so that changes go into the design rather than into ad hoc exceptions. The pilot closes when the team has a written findings log and a signed list of accepted changes from the engineering and quality owners.
Validate antivirus and access rules
The team configures antivirus scanning for inbound uploads, using a scanner such as ClamAV or an ICAP-compatible engine behind the Nextcloud Antivirus for files app, and tests with known-safe and deliberately flagged sample files. It then configures file access control rules, such as blocking downloads or previews from networks outside the plant or the corporate VPN, and tests each rule from inside and outside the approved zones. Scanner signature update paths are confirmed and documented. The output is a test record that shows each rule and each scan behavior as expected, with failed tests logged and retested.
Migrate plants in controlled waves
Each plant moves in its own wave, starting with the folders that are already in use in the pilot and then moving legacy shares and drives in a planned order. The team maps existing permissions to groups, reconciles file counts and checksums after each copy, and keeps the old location read-only until users confirm their work. Plant engineers sign off that the migrated structure matches their working practice. The wave is complete when reconciliation reports show no unexplained differences and the plant lead accepts the cutover in writing.
Hand over runbooks and evidence
The team delivers the operating documentation that the internal administrators will use: installation and upgrade procedures (Nextcloud requires upgrades one major version at a time, with a backup before each), guest onboarding and offboarding steps, antivirus and access rule maintenance, backup and restore tests, and the incident process for a malicious upload. It also delivers the evidence pack, including the data flow register, identity matrix, zone map and test records, so compliance and audit teams can trace each control. The phase closes when the internal owners have run a restore test and a guest offboarding themselves, with results recorded.
What audit and customer assessments ask for from a supplier file exchange
This table lists the evidence an auditor or customer assessor is likely to request from a self-hosted supplier file exchange, the component that produces each item and where teams usually fall short. Use it to plan which logs, exports and records to keep from day one. DeployOpen prepares this evidence, but auditors and certification bodies draw the conclusions.
| Evidence item | Produced by | What to confirm before the assessment |
|---|---|---|
| Access control rule configuration export | Nextcloud file access control rules (admin manual), exported as configuration | Rules that restrict access by network, group or client type are documented with their intended purpose and owner |
| Guest account list and review records | Nextcloud user and sharing administration, plus the review record kept by the file owner | Each supplier guest maps to a named contract, an approved sponsor and an expiry or review date |
| admin_audit log samples | Nextcloud admin_audit log (optional, enabled in the admin manual) | Logging is switched on, log retention meets the customer's requirement and samples cover admin changes and sharing events |
| Antivirus scan logs for inbound files | Nextcloud Antivirus for files app with ClamAV, Kaspersky Scan Engine or an ICAP-compatible scanner | Scanner signature update history is kept, and quarantine or deletion events for infected uploads are retrievable |
| Encryption configuration record | Nextcloud server-side or end-to-end encryption settings, plus key management records | Key ownership, key location and who can recover data are written down, especially for CAD and quality records |
| Backup and restore test records | Backup tooling run by the operator (for example, BorgBackup in Nextcloud All-in-One) and restore test notes | Restores have been tested on a schedule and the results show time to recover and which datasets were verified |
| Upgrade and patch records | Nextcloud upgrade procedure, change tickets and maintenance release notes | Each major upgrade followed the one-version-at-a-time path, with a pre-upgrade backup and third-party apps checked for compatibility |
| Supplier data location and hosting boundary | Infrastructure inventory kept by the company or its operator | Plants, suppliers and customers can see where engineering files are stored, and the boundary matches the scope in the contract |
Questions to ask a file sharing partner before a manufacturing project
Ask the partner to show, in writing, how supplier guest accounts are scoped before any supplier receives access. A manufacturer exchanging drawings and quality records needs each external user limited to the specific folders and share links tied to one supplier, with expiry dates and password requirements set per link. Ask which Nextcloud access control rules they will use to restrict access by network or group, how they will test that a supplier account cannot see another supplier's folder, and who in your organization approves guest accounts and reviews them on a recurring schedule. Request a sample of the audit log entries generated when a guest downloads a file, since that is the record your quality and compliance teams will ask for.
Ask how inbound antivirus will be tested against CAD archives specifically. Nextcloud's Antivirus for files app works with ClamAV, Kaspersky Scan Engine or an ICAP-compatible scanner, but scanning behavior on large compressed assemblies, nested ZIP packages and very large native CAD files is a question for the partner to answer with test evidence, not assumption. Ask for the test plan, the scanner and signature update source, what happens to a file that cannot be scanned in time, and how they will confirm that infected files are removed and users notified. Also ask how segmentation of the server from plant networks will be documented against the ISA/IEC 62443 series, which describes zones and conduits for industrial control systems.
Ask who owns the network design between the file platform and any OT-adjacent segment, and whether the partner will produce a data flow diagram showing which plant systems, if any, can reach the file server. Ask how upgrades will be scheduled, given that Nextcloud does not allow skipping major releases and administrators must upgrade one major version at a time, backing up before each upgrade and disabling third-party apps until they are confirmed compatible. Confirm which Nextcloud support tier is included in the quote, since the Standard, Premium and Ultimate tiers differ in maintenance lifecycle and support hours, and check the current terms on the Nextcloud pricing page before signing. Finally, ask for a documented restore test: the backup scope, the restore target, the measured recovery time, and the date of the last test witnessed by your team.
What manufacturers ask about cost, effort and ownership of file sharing
What are the main cost drivers for self-hosted file sharing in manufacturing?
The total cost is driven by four components: the support or license tier, storage, migration and administration time. Software for Nextcloud and Seafile is open source, so the license line is often zero, but a supported edition, storage hardware or object storage, servers, backup capacity and the people who run the platform are all real costs. Storage usually grows with CAD and drawing archives, so ask for a sizing based on current engineering data volumes and expected growth. Migration from file servers or cloud drives is typically one-time, while support, patching, storage and administration recur every year. Ask any partner for a quote that separates these items so you can compare it with a SaaS subscription on equal terms.
How long does a file sharing pilot take to scope?
The scope of a pilot depends on the number of plants and suppliers involved, how many existing shares or cloud drives must be inventoried, whether directory integration is required and which external sharing rules the quality and engineering teams need. These factors vary too much between manufacturers for a general duration to be reliable, so none is given here. Most engagements are fixed-scope, meaning scope, deliverables and timelines are agreed in writing before work starts. Ask for a written scope that names the pilot users, the file types, the test suppliers and the exit criteria before anyone commits to a timeline.
What does the internal team need to provide for a file sharing project?
Your team needs to supply decisions and access more than hands-on work. Typically this includes a named owner for engineering data classification, the directory structure and group model for plants and suppliers, access to the identity provider or Active Directory for the LDAP, OpenID Connect or SAML integration, and an agreed list of networks that may reach the platform. Quality and document control staff must confirm retention rules for quality records, and IT must provide the infrastructure or cloud accounts where the platform will run. Ask the partner to list these inputs in the scope so that delays caused by missing items can be traced.
Can a manufacturer run self-hosted file sharing in-house?
Yes, many IT teams run Nextcloud or Seafile themselves, but the work is continuous rather than a one-time install. Ongoing tasks include monthly maintenance, major version upgrades, backups with restore testing, antivirus updates, and monitoring of sync and external sharing. Nextcloud publishes a new major version every four months and supports each for one year through monthly maintenance releases, and it does not allow skipping major releases during upgrades, so administrators must upgrade one major version at a time. Ask whether your team has capacity for that cadence, or whether a retainer for upgrades, support and testing would cover the gaps.
How does Nextcloud Enterprise pricing compare with community support?
Nextcloud Server is open source under AGPL-3.0, so the software itself carries no license fee. Nextcloud GmbH sells Nextcloud Enterprise as a paid offering aimed at enterprise, public sector and education users. According to Nextcloud's pricing page, Enterprise is sold in Standard, Premium and Ultimate tiers with a 100-user minimum, with list prices starting at 71.29, 104.99 and 204.75 euros per user per year respectively for 100 or more users, and lower rates from 200 users. Standard includes one-year maintenance, Premium adds a lifecycle of five or more years and clustered instance support, and Ultimate adds support up to 24/7 with response times down to one hour. Community support gives you no contractual response time, so compare the tier's maintenance window and response commitments with your plant downtime tolerance.
What support tier should a manufacturer ask a file sharing partner about?
Ask which support tier applies to the platform and who provides it, since the vendor support tier and the implementation partner's services are separate purchases. Confirm the maintenance lifecycle you will receive, the response times for critical incidents, and whether clustering is supported for multi-site plant access. If you choose a community edition, ask the partner how security patches are applied within the monthly maintenance cycle and who is accountable for testing them. DeployOpen supports upgrades, backups, documentation and support as retainers, and the terms should be written into the scope.
What should a manufacturer ask for in a file sharing quote?
Ask for a quote that lists each item by one-time or recurring category. One-time items usually include design, installation, migration, configuration of access control rules and antivirus integration, and testing. Recurring items usually include software support or maintenance, storage capacity, backup storage, hosting, monitoring and administration hours. Request assumptions for user counts, data volumes, supplier guest accounts and the number of upgrade cycles covered. A clear quote makes it possible to compare self-hosted costs with cloud storage subscriptions, which often price by user and storage allowance.
Which parts of file sharing cost are hard to predict before a pilot?
Migration effort is the hardest to predict, because permissions on legacy shares, duplicate drawing revisions and inconsistent folder structures take time to map. Storage growth is the second unknown, since CAD assemblies and quality records can grow faster than expected once suppliers start uploading. Antivirus scanning load and the number of external guest accounts also affect sizing. A pilot with representative data from one plant and a small supplier group reduces these unknowns before the full rollout is priced.
How DeployOpen works on this
DeployOpen plans, implements, customizes, integrates, hardens, backs up, documents and supports self-hosted open-source platforms inside your own infrastructure. For manufacturing file sharing, that means starting from which plants, suppliers and engineering data sets are in scope, then building the supplier access model, inbound scanning and access rules around them.
How we scope
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.
- The written scope names the plants, suppliers, drawing and CAD repositories, and quality record types included.
- We document which guest accounts, network groups and external sharing paths the design must support.
How we build
- We integrate directory and single sign-on so internal engineers and approved supplier users authenticate consistently.
- We configure antivirus scanning on inbound supplier uploads and confirm how infected files are quarantined and reported.
- We set access control rules by network segment or group and test them against plant and supplier scenarios.
How we hand over
- We document the deployment, access control rules, guest provisioning steps and encryption choices for your team.
- We deliver backup and restore procedures, along with restore tests, so recovery of engineering data is verified.
- We prepare configuration records and audit log evidence that your compliance and quality teams can review.
How we support
- Ongoing support, upgrades and continuous security testing are available as retainers after handover.
- Major version upgrades are planned one at a time, with backups taken and third-party apps checked for compatibility first.
- We can run security testing of the file platform and its integrations, and confirm findings are closed before release.
