Moving off SFTPGo
Stop patching your SFTPGo server. Keep everything your partners rely on.
SFTPGo is free to download, but the server it runs on is yours to patch, watch and expose to the internet. SFTP.cloud runs that part for you. Your hostname, accounts, keys and storage stay as they are, and the inbound port on your network closes.
SFTPGo details checked against SFTPGo, GitHub and NVD sources on 18 October 2026.
Who patches the server
You, from each GitHub release
We do
Inbound ports on your network
Open to the internet
None. The Connector only dials out
Hostname, accounts and storage
Yours
Still yours, unchanged
01Why teams move
The licence is free. Running it on the internet is not.
With open source, nobody pushes a fix to you. Someone on your team watches the release page, tests each version and installs it on the server that holds your files and partner credentials. Free SFTPGo comes with community support; help from its developers requires a paid Enterprise licence or the hosted plan. Every SFTP.cloud plan includes full 24/7 support.
March 2026CVE-2026-30914
Users could step outside their folders.
Rated 8.1, the flaw let a signed-in user craft file paths that bypassed folder permissions and escaped virtual folders, on every version before 2.7.1. The same release fixed a second path traversal, CVE-2026-30915.
October 2026CVE-2026-77375
One malformed message stops the server for everyone.
Before 2.7.5, a single SSH user could send a malformed channel request that ended the SFTPGo process and cut off every connected partner until someone restarted it. A file-filter bypass, CVE-2026-103028, followed the same month.
Every dayInbound port
Your server answers anyone who connects.
Partners reach SFTPGo through a port open to the internet, so does every scanner and botnet. Each login attempt lands on a machine inside your network, next to your files.
On SFTP.cloud, partners connect to us. Your network has no inbound port left to find.
How we secure it02What you keep
Your partners keep connecting the way they do today. One thing changes.
Most migrations stall on the partners: nobody wants to ask a hundred companies to change their scripts. You only need to tell them about one thing.
What stays the same
Hostname, accounts, files.
SFTP.cloud reads SFTPGo’s own export. Run sftpgo dumpdata or export from the admin UI, and import the JSON as it is. How the import reads it
- Keep your hostname, such as sftp.yourcompany.com, with a DNS record
- Import usernames, passwords and SSH public keys, so nobody resets a password or swaps a key
- Bring home and virtual folders, protocols and allow lists across with each account
- Point your Storage Connector at the disk, share or bucket SFTPGo uses today. No files move
What changes
The server’s host key.
SFTP clients check a server’s host key on every connection. SFTP.cloud has its own, so partners see a new fingerprint the first time they connect.
- Send partners the new fingerprint before you switch DNS
- Partners who pin host keys in scripts update one value
- Interactive clients ask once, then connect as before
Same address, same login, same files. A new key, announced in advance.
03Migration steps
Six steps, with SFTPGo running until the last one.
You run the migration yourself, following our documentation. Nothing is switched off until your partners are already working on SFTP.cloud.
- 01
Start a trial and connect your storage.
Install a Storage Connector next to the disk, share or bucket SFTPGo writes to today. It only makes outbound connections.
- 02
Import your accounts.
Run
sftpgo dumpdataand import the JSON: usernames, passwords, SSH public keys, protocols, allow lists and folders. Accounts on S3, Google Cloud Storage or Azure get the same backend on your Connector. - 03
Test with one partner.
Run both side by side. Ask a friendly partner to connect to SFTP.cloud directly and confirm uploads land where they did before.
- 04
Announce the new host key.
Send partners the SFTP.cloud host key fingerprint and the date of the switch, so pinned keys are updated in time.
- 05
Switch DNS.
Point your hostname at SFTP.cloud. Partners keep the address and credentials they already use.
- 06
Retire the SFTPGo server.
Once traffic has moved, close the inbound port and shut the server down. There is nothing left to update.
Your partners change one key. You stop running a server.
Not ready to retire SFTPGo?
Keep it, and close its inbound port anyway. SFTP.cloud can sit in front of your existing SFTP server as its storage, so partners connect to us and your SFTPGo server is no longer reachable from the internet.
04Before you decide
What SFTPGo does that SFTP.cloud does not.
SFTP.cloud covers SFTP, FTPS, FTPES and HTTPS. If you use SFTPGo for more than that, or are weighing its hosted version, check these first. Each comes with a trade-off worth weighing.
- 01
WebDAV or plain FTP.
SFTP.cloud does not accept WebDAV or unencrypted FTP. Partners on plain FTP move to FTPS or FTPES, which most FTP clients already support, and WebDAV users move to the HTTPS web client. The trade-off is one setting per partner, in exchange for no passwords sent in clear text.
- 02
SCP, rsync and other SSH commands.
From the SSH family, SFTP.cloud offers SFTP only, by design: no SCP, shell, SSH commands or tunnels. Scripts that call scp or rsync move to an SFTP client. The trade-off is a script change, in exchange for an SSH service that cannot run anything on the server.
- 03
SFTPGo SaaS, run by its authors.
The SFTPGo team offers a hosted version from €50 a month, which removes the patching. The trade-off is that your files sit on their storage, within plan limits that start at 25 GiB, with audit logs kept for 7 days on the entry plan.
Free software, paid in hours. SFTP.cloud gives those hours back.
05FAQ
Moving off SFTPGo, common questions.
Can I import directly from SFTPGo?
Yes. SFTP.cloud reads the JSON from sftpgo dumpdata or the admin UI export. Users, passwords, SSH keys, protocols, allow lists and folders carry across.
Can I keep my current SFTP hostname?
Yes. Point your existing hostname, such as sftp.yourcompany.com, at SFTP.cloud with a DNS record. Partners keep the address they already use.
Will my partners have to change anything?
Only the host key. SFTP.cloud cannot reuse your SFTPGo server’s host key, so partners see a new fingerprint the first time they connect. Send it to them before you switch DNS.
Do my files have to move?
No. Your Storage Connector can point at the same disk, network share or bucket SFTPGo uses today, and files keep landing there.
Does SFTP.cloud store my files?
No. Files stream through the Storage Connector you run next to your storage and are never written to a disk we own. The Connector only makes outbound connections, so there is no inbound rule to your network.
Does SFTP.cloud support WebDAV, SCP or rsync?
No. SFTP.cloud supports SFTP, FTPS, FTPES and an HTTPS web client. From the SSH family it offers SFTP only, by design: no SCP, shell, SSH commands or tunnels.
Do you migrate it for me?
Migration is self-service and documented step by step. You can run SFTP.cloud alongside SFTPGo for as long as you need before switching.
Can I keep SFTPGo and just close the inbound port?
Yes. SFTP.cloud can use your existing SFTP server as its storage. Partners connect to SFTP.cloud, which passes files to your SFTPGo server over an outbound connection, so the server is no longer exposed to the internet.
Run it next to SFTPGo for fourteen days.
Connect the storage SFTPGo uses, import your dump and test with one partner before anything changes. No credit card, and nothing to cancel if it is not for you.
Want the details first? Read about security or SFTP for on-premises storage.