Security & audit
Encryption you can cite. A record you can export. Assessments you can verify. What security reviewers ask about file transfer, answered on one page, with the evidence.
Every file on Sharetru is encrypted in transit and at rest with FIPS-validated modules, scanned, and written to one record by account, time, protocol and file. A-LIGN examines the service every year; FITS, a FedRAMP assessor, examines Sharetru Federal. The record is yours to export: CSV, syslog to your SIEM, or the API.
- EncryptAES-256 at rest on both. Sharetru Commercial: TLS 1.2 in transit, FIPS 140-2 modules. Sharetru Federal: TLS 1.3, FIPS 140-3 modules
- RecordEvery sign-in, view, upload, download, link and permission change, by account
- KeepLogs 3, 6, 12 or 72 months by plan; a retention rule per folder that runs daily
- ProveSOC 2 Type II and HIPAA reports under NDA; the FedRAMP listing in public
15-day free trial on Core or Complete · Every protocol and the API included · Unlimited guests on every plan
Answering a questionnaire? Bring it to a 30-minute security and compliance review, or read who has assessed Sharetru first.
The states every Sharetru site runs, with the platform differences marked. The retention rule is one administrator’s example. Illustrative panel.
Across the platform
Do the same encryption and the same record cover every way a file moves?
Yes: the web app, share links, SFTP, FTPS, FTPeS, SCP and the REST API share one site, one set of folders, permissions and logs. At rest and on the record, the path makes no difference; in transit it is TLS 1.2 on Sharetru Commercial, TLS 1.3 on Sharetru Federal, or SSH for SFTP and SCP.
Who may sign in, from where and with what is the access management page; this page is what happens to the file, and the record it leaves.
People
The web app and share links over HTTPS: every sign-in, view, upload and download by a named account or registered guest lands on the log
Systems
SFTP, SCP, FTPS and FTPeS for scripts and partners’ servers: the session, each command and each file on the log, with the IP address
Software
The REST API for files, users and groups, with the activity log readable over the API as well
Three questions, three owners
A questionnaire, an audit and a retention policy ask three different people the same thing: show me
What encrypts the files, and who checked. Who touched a file, and when. What was deleted, and on whose schedule. On a server you run, each answer is a configuration someone set once; on Sharetru, each is a fact of the service with a record behind it.
Holding a questionnaire this week? Bring it to a 30-minute security and compliance review and you get written answers afterwards; the SOC 2 and HIPAA reports follow once you are in a trial or an account under the Terms of Service NDA.
Request the review-
The questionnaire
A client, a prime or a cyber-insurer asks what encrypts the files, with which validated modules, and who attested to it
On a self-run SFTP server the honest answer is a cipher list someone configured, a certificate that expires and, often, no third party who has looked.
Fixed by AES-256 at rest and TLS in transit, 1.2 on Sharetru Commercial and 1.3 on Sharetru Federal, through FIPS-validated modules, on a service A-LIGN examines every year, with the SOC 2 Type II report under NDA.
-
The audit
An auditor asks who opened a file last March, and the server log was rotated in April
Access history on a server you run lives in a syslog with whatever retention someone once set, and the web portal keeps a different log in a different format somewhere else.
Fixed by one record for every path, view, upload, download, link and permission change, by account, kept 3, 6, 12 or 72 months by plan and exported to CSV, syslog or the API.
-
The retention policy
The policy says delete after 90 days; the folders say nothing has been deleted since 2019
Retention on paper and retention in storage drift apart when deleting is a manual job, and an incident exposes whatever was never cleaned up.
Fixed by a retention rule per folder that runs every day, deletes on the schedule you set and writes each deletion to the log.
Independent assessment
Who has examined Sharetru’s security, and which layer did they examine?
Three assessors, one per layer: A-LIGN for the Sharetru service, FITS for Sharetru Federal, and each infrastructure provider’s own auditors. Read down the column for your platform. A questionnaire that asks for “the SOC 2” usually wants two documents: Sharetru’s, with a trial or an account, and the data-center provider’s, from the provider.
Which assessment covers which layer
Reports under NDA come with a trial or an account · the FedRAMP listing is public
| Layer | Sharetru Commercial | Sharetru Federal |
|---|---|---|
The Sharetru serviceSaaS · what you sign in to |
SOC 2 Type II Attested · HIPAA Security Rule, assessed annually A-LIGN · every year · the current report under NDA in a trial or as a customer | FedRAMP Moderate Certified (Class C) · package F1311222650 · every control and objective in the Moderate baseline assessed, this layer and the one below First Information Technology Services (FITS), a FedRAMP-recognized 3PAO, now “assessor” in FedRAMP’s terms: the 233 controls Sharetru implements, every year, with penetration test and red team · the rest of the baseline is GovPoint’s, assessed one row down |
Platform and infrastructurePaaS and IaaS · where it runs |
DataBank · SOC 1 (SSAE 18) · SOC 2 Type II · SOC 3 · HIPAA/HITECH · ISO 27001 · FISMA Moderate · CSA STAR Level 2 · EU-U.S. DPF the provider’s own attestations · named as a subservice organization in Sharetru’s SOC 2 report | GovPoint Cloud Services (MIS Sciences Corporation) · the FedRAMP package itself IaaS, PaaS and SaaS in one boundary · Government Community Cloud · the Moderate-baseline controls Sharetru Federal inherits or shares, assessed in GovPoint’s annual assessment: with FITS’s 233 above, every control and objective in the baseline |
Where the data livesand who administers it |
U.S. data centers · U.S.-citizen staff · backups every day the HIPAA Support Package adds a disaster recovery plan, the HIPAA Security Rule’s requirement | U.S. data centers, production and a secondary disaster recovery data center · U.S.-citizen staff inside the GovPoint boundary · the FedRAMP requirement |
How you get the reports: the SOC 2 Type II and HIPAA reports under the Terms of Service NDA, in a trial or as a customer; the FedRAMP listing in public, the package through FedRAMP; the providers’ attestations from the providers. Nothing on this page replaces reading them.
How it works
What happens to a file between the upload and the auditor’s export?
Four things, every time: encrypted in transit, scanned, encrypted at rest, and written to the record by account, time, protocol and file name. Every later action adds a line to the same record: view, download, link, rename, delete, permission change. A guest’s download by link and a server’s SFTP session land in one log, in one format.
What one file leaves behind
Your user or your system sends it. Four controls act on it. The auditor reads the record.
Swipe sideways to see it all → →
Recorded once, per action.
Date, protocol, process, port, IP address, user, command, arguments, file name, bytes and status: the fields on every line of the log export, for a guest’s browser download and a server’s SFTP command alike.
Encrypted twice, with validated modules.
TLS on the way in and out, 1.2 on Sharetru Commercial and 1.3 on Sharetru Federal, or SSH; AES-256 at rest. The modules are FIPS 140-2 validated on Sharetru Commercial and FIPS 140-3 validated on Sharetru Federal. File-level PGP is yours to add where a partner requires it.
A record of every action, not a copy of every file.
When a file is replaced or deleted, the log shows when and by whom; the earlier contents are not kept. Sharetru is the exchange point, not your system of record, so keep versions where your policy requires.
See the record on your own Sharetru site, free for 15 days.Upload a file, share it, download it, and export the log lines it left.
Fixed, and yours to set
Which security and retention settings are fixed, and which does an administrator set?
Encryption, scanning and backups are the service’s; protocols, log forwarding, retention rules and the Auditor roles are yours to set. Protocols and forwarding apply site-wide, retention rules per folder, the roles per user; log retention follows the plan. Sharetru Federal fixes more: its presets sit at the FedRAMP Moderate baseline and move one way, tighter.
The record
What can we hand an auditor, and where does each piece come from?
Your log export, the administrator reports, the SOC 2 Type II and HIPAA reports under NDA and, on Sharetru Federal, the public FedRAMP listing. The first two are yours from the first day of a trial; the reports come with a trial or an account under the Terms of Service NDA; the listing is open to anyone.
- CSV
The activity log: what happened
One line per event, sign-in, upload, download, rename, delete, link, permission change, with date, protocol, process, port, IP address, user, command, arguments, file name, bytes and status.
Yours - CSV
Administrator reports: who can reach what
Users, Access (every user, folder and permission), Logins by Protocol and User Agreement, each exportable to CSV: the inventory an auditor reads beside the log.
Yours - TYPE II
The SOC 2 Type II and HIPAA reports
A-LIGN’s attestation on the Sharetru service over the report period, with the subservice organizations named, and its assessment against the HIPAA Security Rule from the same engagement.
In a trial · NDA - PUBLIC
The FedRAMP Marketplace listing
Package F1311222650 names Sharetru Federal under Certified Services. The package itself (SSP, assessment report, POA&M) goes to federal agencies through FedRAMP, not through Sharetru.
A questionnaire that asks for “the SOC 2” usually wants two documents: Sharetru’s report and the data-center provider’s. Sharetru’s comes with a trial or an account; the provider’s comes from the provider. Say which platform your site runs on.
Where to get the record
- Logs pagefilter by user, date or event, then export CSV
- SIEMforwarded by syslog
- REST APIthe activity log
- ReportsUsers, Access, Logins by Protocol, each to CSV
What the review gives you
- Written answersto your questionnaire, after the 30 minutes
- Where each report comes fromSharetru’s SOC 2 and HIPAA reports with a trial or an account; DataBank’s from DataBank
- FITS’s letter of attestationfor Sharetru Federal; the FedRAMP package only through FedRAMP, for agencies
- The next stepa trial under the Terms of Service NDA, or a demo on sample files
Sharing the SOC 2 or HIPAA report beyond your own assessors needs our agreement first: the NDA in the Terms of Service governs who may see them.
Swipe sideways to see the whole row →
yourcompany.sharetru.com · activity log · illustrative export
Illustrative entries, with invented names. One line per action, never one per file: Sharetru keeps no prior versions, and the log shows when a file was replaced or deleted and by whom, a retention rule included. The real export carries date, protocol, process, port, IP address, user, command, arguments, file name, bytes and status.
Which Sharetru
Sharetru Commercial or Sharetru Federal: what differs for security and the record?
The same record, roles and U.S.-citizen administration on both; Sharetru Federal adds the FedRAMP boundary, TLS 1.3, FIPS 140-3 modules and 12 months of logs. Both encrypt at rest with AES-256; Sharetru Commercial runs TLS 1.2 with FIPS 140-2 modules. Pick by what the contract names: FedRAMP Moderate, CUI or ITAR technical data means Sharetru Federal.
Regulated commercial data
For healthcare, financial services, manufacturing and professional services exchanging PHI, financial records and engineering files with partners.
- SOC 2 Type II Attested; HIPAA audited annually by A-LIGN
- FIPS 140-2 validated modules; AES-256 at rest; TLS 1.2 in transit
- Logs 3 months on Core, 6 on Complete; export any time; SIEM forwarding on both
- HIPAA Support Package: Sharetru’s signed BAA, 72 months of logs, failed-login policies and a disaster recovery plan, $100 a month on the plan page today
- U.S.-citizen administration; DataBank data centers in the U.S., with the provider’s SOC 1, SOC 2, SOC 3, HIPAA/HITECH, ISO 27001, FISMA Moderate, CSA STAR Level 2 and EU-U.S. DPF attestations
CUI, ITAR and federal contracts
For contracts that name FedRAMP Moderate, and for CUI, covered defense information or ITAR technical data.
- FedRAMP Moderate Certified (Class C), package F1311222650 on the FedRAMP Marketplace
- FITS, a FedRAMP 3PAO, assesses the 233 controls Sharetru implements every year, with penetration testing and red teaming; the rest of the FedRAMP Moderate baseline is GovPoint’s, assessed in its annual assessment, so every control and objective in the baseline is assessed across the full stack
- FIPS 140-3 validated modules; AES-256 at rest; TLS 1.3 in transit on Sharetru Federal, TLS 1.2 not offered
- Logs 12 months whatever the plan underneath; watermark on every guest view
- U.S.-citizen administration; production and a secondary disaster recovery data center, both in the U.S.; presets at the FedRAMP Moderate baseline, tighten only
FAQ
What security reviewers ask about encryption, retention and the record
Encryption
How are files encrypted on Sharetru?
In transit with TLS (1.2 on Sharetru Commercial, 1.3 on Sharetru Federal) or SSH; at rest with AES-256 through FIPS-validated modules. The modules are FIPS 140-2 validated on Sharetru Commercial and FIPS 140-3 validated on Sharetru Federal. Plain FTP, which carries no encryption, exists on Sharetru Commercial only and a site administrator can switch it off for the whole site.
Which TLS version does Sharetru use?
TLS 1.3 only on Sharetru Federal, where TLS 1.2 is not offered; TLS 1.2 only on Sharetru Commercial. That covers the web app, share links, FTPS, FTPeS and the REST API; SFTP and SCP ride on SSH.
If a requirement names TLS 1.3, or says TLS 1.2 must be off, the answer is Sharetru Federal. Say which platform your site runs on when you bring a questionnaire to the review.
Is Sharetru FIPS 140-2 or FIPS 140-3 validated?
Both, by platform: Sharetru Commercial uses FIPS 140-2 validated modules and Sharetru Federal uses FIPS 140-3 validated modules. The validation belongs to the cryptographic modules, not to Sharetru as a whole. If your framework requires FIPS 140-3 validated modules behind the application, the answer is Sharetru Federal.
Is it end-to-end encryption?
No: files are encrypted in transit and at rest, and the service decrypts them to scan for viruses and to render view-only pages. That is what lets Sharetru enforce a scan and, on Sharetru Federal, a watermark. A reviewer who needs end-to-end encryption in the strict sense needs file-level encryption on your side.
Can we add PGP or our own file-level encryption?
Yes, on your side: Sharetru holds no PGP keys and does not encrypt file contents for you, so encrypt before upload and decrypt after download. Transport and storage encryption still apply to the encrypted file, and the log still records every action on it.
Retention and backups
How long are logs kept?
3 months on Core, 6 on Complete, 12 on Sharetru Federal whatever the plan underneath, and 72 with the HIPAA Support Package. Export them any time, by CSV from the Logs page, by syslog to your SIEM or over the API, and keep them as long as your own policy requires.
Can files be set to delete automatically?
Yes: a retention rule on a folder or workspace deletes files older than the days you set, runs daily, and logs each deletion. A rule can include empty subfolders. A folder with no rule keeps its files until someone deletes them, and that deletion is logged too.
Are files backed up, and is there disaster recovery?
Backups run every day; Sharetru Federal has a secondary disaster recovery data center, the HIPAA Support Package a disaster recovery plan. Each is what its framework requires: FedRAMP asks for the standby site, the HIPAA Security Rule for the plan. Ask for the recovery objectives for your platform during the trial; keep your own copies where your policy requires.
Does Sharetru keep earlier versions of a file?
No: Sharetru keeps a record of every action, not a copy of every file, so a replaced or deleted file’s earlier contents are not retained. The log shows when it was replaced or deleted and by whom. Keep versions in the system where the file is authored.
The record
What exactly is logged?
Every sign-in, view, upload, download, rename, delete, link and permission change, against a named account, with the time, protocol, IP address and file. The export carries date, protocol, process, port, IP address, user, command, arguments, file name, bytes and status. Guests appear under the address they registered with; a server appears under its account and IP address.
Can Sharetru send logs to our SIEM?
Yes: the log is forwarded by syslog to any syslog target, so your SIEM keeps the record on its own retention. Splunk, Microsoft Sentinel, QRadar, Sumo Logic and others are named targets; SIEM integration is on Core and Complete per the plan page, and a Sentinel data collection endpoint is the native path for Microsoft shops.
Are SFTP sessions logged the same way as web uploads?
Yes: a server’s SFTP session and a person’s browser upload land on the same log, one line per command, with protocol and IP address. Which accounts may use which protocol is set per user on the access management page; per-user IP rules are a Complete feature.
Can an auditor review the site without being able to change anything or open a file?
Yes, with two read-only roles: the Site Auditor for settings, users, permissions and reports; the Files Auditor for folder and file names. Neither can change anything or open, download or preview a file. Give a role to your compliance officer or an outside assessor for the review period and remove it afterwards.
A Site Auditor views site settings and the dashboard, users, groups and their permissions, every folder’s access, notification, retention and share settings, and all reports, including the administrator activity log, API activity and the email and SMS logs, but never a file name. A Files Auditor sees the name of every folder and file, to confirm what is stored and where, and nothing of what is inside.
Assessments and where data lives
Is Sharetru SOC 2 certified?
SOC 2 is an attestation, not a certification: Sharetru is SOC 2 Type II Attested, with A-LIGN’s report under NDA during your trial. The data-center provider’s own SOC 2 report is a separate document; a questionnaire that asks for “the SOC 2” usually wants both.
Is Sharetru ISO 27001 certified?
No: Sharetru itself holds no ISO 27001 certificate; under Sharetru Commercial the data-center provider, DataBank, does. DataBank also holds SOC 1, SOC 2, SOC 3, HIPAA/HITECH, FISMA Moderate, CSA STAR Level 2 and the EU-U.S. DPF. If your questionnaire needs ISO 27001 at the application layer, say so in the review and we answer in writing.
Where is our data stored, and who can reach it?
In U.S. data centers on both platforms, administered by Sharetru’s U.S.-citizen staff: DataBank for Sharetru Commercial, the GovPoint FedRAMP boundary for Sharetru Federal. GovPoint is run by MIS Sciences Corporation; on Sharetru Federal, production and disaster recovery are both inside that boundary. Both providers are named as subservice organizations in Sharetru’s SOC 2 report.
Does Sharetru scan uploads for viruses?
Yes: files are scanned for viruses on the service, which is one reason Sharetru decrypts files server-side rather than claiming end-to-end encryption. Scanning runs on the service, not on your side.
Has Sharetru been penetration tested?
Sharetru Federal is, every year: FITS, the FedRAMP 3PAO, includes penetration testing and red-team exercises in its annual assessment. The most recent assessment covered the 233 controls Sharetru implements; GovPoint’s own annual assessment covers the rest of the FedRAMP Moderate baseline.
For Sharetru Commercial, ask in the security and compliance review and you get the answer in writing.
Does the FedRAMP assessment cover every control, or only Sharetru’s 233?
Every control and every objective: FITS assesses the 233 controls Sharetru implements, and GovPoint’s annual assessment covers the rest of the FedRAMP Moderate baseline. Together that is the whole NIST SP 800-53 Rev 5 Moderate baseline, every control and every assessment objective, assessed across the full technology stack.
Sharetru Federal runs inside GovPoint’s FedRAMP boundary, so the infrastructure and platform controls, inherited or shared, are GovPoint’s to implement and assess, and the application controls are Sharetru’s, assessed by FITS every year. Which control sits with whom is recorded in the package’s Appendix J; bring the question to the review and the answer comes in writing.
Can you complete our security questionnaire?
Yes: bring it to the 30-minute security and compliance review and you get written answers afterwards. Attach the questionnaire to your reply to our email and say which platform your site runs on; the SOC 2 and HIPAA reports follow once you are in a trial or an account under the Terms of Service NDA.
Next step
Bring us your questionnaire, or start a trial and export your first log line.
Either way you leave with evidence: a site of your own with the record running, or written answers to a reviewer’s questions.
Rather see the record being written first? Request a 60-minute demo on a live Sharetru site with sample files. Not a compliance project? Talk through how you move files today.
Sources: the Sharetru Knowledge Base, the Sharetru plan page, the scope of A-LIGN’s SOC 2 Type II and HIPAA engagements, the FedRAMP Marketplace listing for package F1311222650 with FITS’s letter of attestation, the infrastructure providers’ published attestations and the Sharetru developer documentation. Product screens, names, files and log entries on this page are illustrative. Nothing on this page is legal advice or a statement about the outcome of your assessment.