Product 02
A proactive FTP server. Conventional transfer servers are passive: they accept a file, drop it in a folder and wait for someone to notice. SftpS authenticates the sender against your certificate authority, inspects what arrived, moves it into the system that needs it, and tells the people who were waiting — in the same breath.
Proactive by design
Almost every organisation has the same piece of infrastructure hiding somewhere: an FTP server, a shared folder, and a cron job that looks in it every five minutes. It works until the day the file lands malformed, or lands twice, or does not land at all — and nobody finds out until a customer calls.
SftpS removes the gap between arrival and action. Every connection is authenticated against an authority rather than a password list. Every file is checked before it is accepted. Every accepted file triggers the work it was sent for, and every outcome — success, rejection, retry — is announced on the channel the responsible team actually watches.
Arrival, completion, rejection and quota events fire the moment they happen, to any combination of channels.
Access is a certificate your CA issued, not a password in a spreadsheet. Offboarding is one revocation.
Files are handed directly to storage, databases, ERP intake or an n8n workflow — no intermediate scraper.
Who connected, from where, with which credential, moving which bytes — append-only and exportable.
Files are encrypted the moment they land and stay that way on disk. A stolen volume or a misplaced backup yields ciphertext, not customer data.
Authentication
Mix them per account. A bank counterparty can use mTLS, your CI runner an SSH certificate, and your operations lead a hardware passkey — on the same server, under the same policy.
The client presents a certificate issued by your authority and the server verifies the whole chain, live, on every connection.
Short-lived SSH certificates signed by your CA replace the sprawl of authorized_keys files nobody has audited in years.
Classic public-key authentication, kept for the integrations that cannot change today — but managed properly.
A passkey replaces the password with a key the user cannot read, retype or be tricked into repeating over the phone.
Architecture
Authenticate the party, apply the policy, then act — and keep an unforgeable record of all three.
Client compatibility
SftpS speaks standard SFTP and FTPS. There is no proprietary client to roll out and no training day to schedule.
| Client | Platform | Notes |
|---|---|---|
| WinSCP | Windows | PKCS#11 for YubiKey, saved sites, scripting and .NET assembly |
| FileZilla | Windows, macOS, Linux | Site manager profiles with client certificates and key files |
| OpenSSH sftp | Linux, macOS, Windows 10+ | Batch mode and resume for scheduled and CI transfers |
| scp | Linux, macOS | Drop-in for existing scripts, with SSH certificate support |
| Your application | Any platform | Native SDK plus a REST control plane for accounts and events |
Notifications
Every event can fan out to any combination of channels, per account and per folder.
For the transfers where a delay costs money before anyone opens a laptop.
Rich receipts with checksums, sizes and the certificate subject that sent them.
Group or channel alerts for the operations team, with inline retry actions.
Signed JSON to your own endpoint, so downstream systems react programmatically.
Specification
Standard protocols on the outside, an event pipeline on the inside.
Give us one of your existing transfer flows and we will stand it up on SftpS in a pilot environment, with your own clients and your own certificates.
