EN
Start free 30-day trial

DORA File Transfer Compliance Checklist.

DORA Article 28 expects every EU financial entity to map, monitor, and audit file transfer as a critical ICT third-party dependency. The checklist below is what compliance officers and IT leads walk through before each annual review.

The checklist

Fourteen controls, grouped by DORA theme.

Each item states what to verify and where xEvolve stands today, gaps included. Bring it to your next ICT risk committee.

  1. ICT risk management

    • Documented ICT risk framework covering file transfer

      Verify: Policies identify file transfer as a critical ICT dependency, with risk owners and review cadence.

      xEvolve: Audit log and export on request supply the evidence; the risk framework and its owners stay your document.

    • Annual review of third-party transfer providers

      Verify: Concentration risk, substitutability, and exit strategy are reassessed at least yearly.

      xEvolve: Exit clause + portability of your tenant schema in shared EU Postgres plus R2 file storage, documented in every customer agreement.

  2. ICT third-party register

    • Every transfer provider recorded in the ICT register Gap today

      Verify: Provider name, service, data flows, sub-processors, and 4-eyes sign-off are captured.

      xEvolve: Activity log in the dashboard; audit export on request. No provider record or sign-off workflow yet: keep your ICT register outside xEvolve.

  3. Incident detection & reporting

    • Initial incident classification within agreed thresholds Gap today

      Verify: Major ICT-incident criteria are pre-mapped; reporting timeline rehearsed with the lead overseer.

      xEvolve: E-mail and webhook alerts on failed transfers, blocked uploads and failed sign-ins. No severity routing or anomaly detection yet.

    • Voluntary early warning channel to management

      Verify: A documented escalation path lets the CISO notify the competent authority before deadlines hit.

      xEvolve: Webhook + email escalation to your IR team with templated messages.

  4. Encryption in transit + at rest

    • TLS 1.2+ on every control and data channel

      Verify: No legacy ciphers, no plain FTP, no self-signed certs in production paths.

      xEvolve: TLS 1.2 or newer (TLS 1.0 and 1.1 are refused), modern cipher suites, HSTS with includeSubDomains on every customer domain.

    • At-rest encryption with managed keys

      Verify: Storage layer is encrypted; key rotation cadence and KMS ownership are documented.

      xEvolve: Files in Cloudflare R2: provider encryption at rest plus application-level encryption with an xEvolve-managed key. No customer-managed KMS and no automatic key rotation yet.

  5. Identity (Entra / OIDC SSO + MFA)

    • SSO via Entra ID or OIDC; phishing-resistant MFA

      Verify: Local accounts disabled for staff; admins require FIDO2 / platform passkey.

      xEvolve: Sign-in goes through Spot Suite single sign-on (Microsoft account or e-mail code). xEvolve has no MFA of its own; SCIM is on the roadmap.

  6. Audit trail & access logging

    • Audit log of every transfer and Console action

      Verify: Logs cover who/what/when, source and destination, and hashes, and are retained for the period you need.

      xEvolve: Audit log with actor, IP, and timestamp per event. Audit logs are kept and never deleted automatically; audit export on request.

    • Privileged access to audit data is logged and reviewed Gap today

      Verify: Read access to audit exports triggers an alert and is reviewed quarterly.

      xEvolve: Reading the audit log is not logged separately and xEvolve sends no review reminders; export on request and review on your own cadence.

  7. Retention & legal hold

    • Configurable retention with legal-hold override

      Verify: Retention windows match regulator expectations; legal hold freezes deletion per matter.

      xEvolve: Per-Environment retention period in days, set by an admin; one-click legal hold per file with an end date you choose.

  8. EU data residency

    • Files + metadata stay inside the EU jurisdiction

      Verify: Region of storage is contractually committed and verifiable in the console.

      xEvolve: EU hosting (Supabase Paris); files in Cloudflare R2 in Western Europe, not locked to an EU jurisdiction.

  9. Resilience / DR testing

    • Documented RTO / RPO with periodic DR test Gap today

      Verify: Recovery objectives are tested at least annually; results are filed with risk committee.

      xEvolve: Gap today: hourly logical dump of the database to Cloudflare object storage plus daily provider backups (Supabase, Paris, about a week kept), but no point-in-time recovery, no failover between regions and no DR test has run yet, so RTO/RPO are not documented. Ask us for the current backup and restore posture.

  10. Signed delivery receipts

    • Sender and recipient both receive a signed, time-stamped receipt

      Verify: Receipts are non-repudiable and stored alongside the file for the retention period.

      xEvolve: Signed delivery receipt (HMAC-SHA256) for every download and share-link delivery, written to the audit log.

Move from checklist to production.

One Environment, 13 protocol adapters, an EU database (Paris), Spot Suite single sign-on, audit logs kept and never deleted automatically, and signed delivery receipts — all in the 30-day trial.

Start free 30-day trial Book a demo