SFTP.cloud vs Cleo
Cleo is built for EDI. SFTP.cloud is built for SFTP into storage you own.
Both give your partners SFTP and FTPS. Cleo Integration Cloud is a B2B integration platform, and partner files arrive in mailboxes on Cleo's cloud. SFTP.cloud streams each file straight into storage you own and never keeps a copy.
Cleo details checked against Cleo documentation and public security advisories on 15 October 2026.
What it is
A B2B and EDI integration platform
Managed SFTP, FTPS and HTTPS
Where partner files arrive
A Partner Mailbox on Cleo's cloud
Only in your storage
Price
Quote only
Published, from $2,400 a year
01The public record
What a vulnerability reaches depends on what the server holds.
Every product may have vulnerabilities. These advisories cover Cleo Harmony, VLTrader and LexiCom, the Cleo file transfer products you install and run yourself. Cleo released fixes for each.
October–December 2024CVE-2024-50623
Unrestricted file upload and download.
Cleo disclosed it on 30 October 2024 as a flaw that could lead to remote code execution. In December, Huntress reported active exploitation and found that systems on the patched version 5.8.0.21 were still exploitable.
December 2024CVE-2024-55956
A second file write flaw, exploited as a zero-day.
Rapid7 described it as a separate unauthenticated flaw in the same endpoint. Cleo fixed it in version 5.8.0.24. Both CVEs are on CISA's Known Exploited Vulnerabilities list, and Recorded Future reported the Cl0p ransomware group exploiting both.
With SFTP.cloud, the same class of flaw finds no files. They are never written to a disk we own, and we hold no credentials to the storage where they are.
How our security works02Files and credentials
Cleo hosts the mailbox. SFTP.cloud passes files through.
In Cleo Integration Cloud, partners connect to a Partner Mailbox on your Cleo tenant, and the platform moves files on from there. SFTP.cloud is built so that the service your partners connect to never holds a copy.
Cleo
Partners drop files into a mailbox on Cleo's cloud.
Partner Mailbox endpoints run on your tenant at cleointegration.cloud, over SFTP, FTP, FTPS or the Cleo Portal web client.
- Files wait in the mailbox until they are downloaded and deleted
- Since April 2025, mailbox folders can be linked to Amazon S3, Azure Blob or Google Cloud Storage through endpoints configured in Cleo
- With linked storage, Cleo's platform makes the connection to your bucket or container
- Cleo Harmony, VLTrader and LexiCom are the versions you install on your own servers and patch yourself
SFTP.cloud
Your storage. Nothing else.
Files stream through a Storage Connector you run next to your storage. They are never written to a disk we own.
- We hold no access key, secret key, OAuth refresh token or service principal, and you never grant us a cross-account role
- Your Connector authenticates to your storage with credentials you created and stored where you chose. Rotate them without telling us
- The Connector only dials out, so there is no inbound rule to your network
- We run and patch the transfer service your partners connect to
A mailbox in someone else's cloud holds a copy of your data. With SFTP.cloud, there is no copy on ours.
03Defences
What stands between an attacker and your storage.
Keeping your files off our servers removes the prize. These four layers make the service itself hard to attack, and every SFTP.cloud plan includes all of them.
- 01
Shield turns attackers away before the handshake.
Shield remembers how every source address behaves and catches fast brute-force attempts and slow, spread-out botnets alike. Banned sources are dropped at TCP accept, before any SSH or TLS key exchange begins.
- 02
Post-quantum key exchange on every protocol.
SFTP negotiates the hybrid
mlkem768x25519-sha256, and FTPS, FTPES and HTTPS use post-quantum cipher suites, so traffic recorded today stays unreadable later. - 03
Mutual TLS between every component.
The Head, the control plane and your Connector authenticate each other with certificates on every connection. A foothold on the network between them is not a way in.
- 04
Two signed audit records you can check yourself.
Your Connector and our Head each keep a signed, chained record of every session. Download the evidence file and verify it with logverify, an open-source tool that needs nothing from us.
If we are breached, you are not.
04Side by side
Running it, storage and protocols, line by line.
Checked on 15 October 2026
| Cleo | SFTP.cloud | |
|---|---|---|
| Running it | ||
| What it is | A B2B integration platform covering EDI, APIs and file transfer | A managed file transfer service for SFTP, FTPS, FTPES and HTTPS |
| How it is delivered | Cleo Integration Cloud, hosted by Cleo, or Harmony, VLTrader and LexiCom installed on your servers | A managed service, with a Storage Connector you run next to your storage |
| Who patches the transfer server | Cleo, for Cleo Integration Cloud. You, for the products you install | We do |
| Price | Quote only, not published | Published: Shared $2,400 a year, Dedicated $8,400 a year |
| Storage | ||
| Where partner files arrive | A Partner Mailbox on Cleo's cloud, optionally linked to S3, Azure Blob or Google Cloud Storage | Only your storage |
| Connection to your storage | Made by Cleo's platform, through endpoints configured in Cleo | Made by your Connector, with credentials that never leave it |
| Protocols and automation | ||
| Protocols | SFTP, FTP, FTPS, AS2, OFTP2 and RNIF, plus APIs | SFTP, FTPS, FTPES and an HTTPS web client |
| EDI translation | Included | Not offered |
| Workflow automation | Built-in workflows and ERP integrations | SyncJS scripting, included |
Cleo information comes from Cleo documentation and public security advisories as of the date above and may have changed since. Prices exclude taxes. Cleo, Cleo Integration Cloud, Harmony, VLTrader and LexiCom are trademarks of Cleo Communications. SFTP.cloud is not affiliated with or endorsed by Cleo.
05Choosing
When Cleo is the better fit.
The two products overlap on file transfer, but Cleo covers far more ground. In these cases, Cleo is the more direct choice.
- 01
You exchange EDI documents.
Cleo translates EDI, connects to ERP systems and onboards trading partners. SFTP.cloud moves files and does not read or transform them.
- 02
Your partners require AS2, OFTP2 or RNIF.
Cleo supports these B2B protocols. SFTP.cloud supports SFTP, FTPS, FTPES and HTTPS.
- 03
You want someone else to run your integrations.
Cleo offers managed services alongside self-service. With SFTP.cloud, you set up accounts and scripts yourself.
If what you need is SFTP into storage you control, without an integration platform around it, that is what SFTP.cloud is built for.
06FAQ
SFTP.cloud and Cleo, common questions.
Is SFTP.cloud an alternative to Cleo?
For SFTP, FTPS and web file transfer with your partners, yes. Cleo Integration Cloud is a broader B2B integration platform that also covers EDI, APIs and AS2. If secure file transfer is what you need, SFTP.cloud streams each file into storage you own and never keeps a copy.
What were the Cleo vulnerabilities in 2024?
CVE-2024-50623 and CVE-2024-55956 are unauthenticated file write flaws in Cleo Harmony, VLTrader and LexiCom, the Cleo products you install yourself. Both were exploited in December 2024 and are on CISA's Known Exploited Vulnerabilities list. Cleo fixed them in version 5.8.0.24.
Does SFTP.cloud store my files or my storage credentials?
No. Files stream through the Storage Connector you run next to your storage and are never written to a disk we own. The Connector authenticates to your storage with credentials that never leave it.
Do I have to install or patch a transfer server?
No. We run and patch the transfer service your partners connect to. You run a Storage Connector next to your storage, and it only makes outbound connections.
Does SFTP.cloud support EDI or AS2?
No. SFTP.cloud moves files over SFTP, FTPS, FTPES and an HTTPS web client, and does not read or transform them. If you need EDI translation or AS2, Cleo is built for that.
How is SFTP.cloud priced?
Prices are published. Shared is $2,400 a year with 15 transfer accounts and 3 Storage Connectors included, and Dedicated, on your own VM, is $8,400 a year. There is no per-gigabyte or transfer charge. Cleo pricing is quoted on request.
Your files, never on our servers.
Connect your own storage, invite a partner and send your first file. No server to install or patch. Fourteen days, no credit card, and nothing to cancel if it is not for you.
Want the details first? Read about security or how it works.