SFTP.cloud vs Files.com
Same protocols. A different answer to who holds your keys.
Both put SFTP, FTPS and a web client in front of storage, and both run it for you in the cloud. They differ on where your files live, who holds the credentials to your storage, and how each connection is encrypted.
Files.com details checked against its public website and documentation on 15 October 2026.
Where your files live
Files.com storage by default, or a mount of your own
Only in your storage
Credentials to your storage
Stored by Files.com, encrypted
Never leave your Connector
Post-quantum key exchange
Not in its published SFTP or HTTPS lists
On every protocol
01Files and credentials
Where your files live, and who can reach them.
Files.com is built around its own storage, and can also mount yours. SFTP.cloud only ever works with yours. That choice decides what a vendor has to hold to make it work.
Files.com
Its storage by default. Yours as a mount.
Every plan includes Files.com storage. Remote Server Mounts present your own buckets and servers as folders on your Files.com site.
- Starter includes 1 TB of monthly storage and transfer, with more at $100 per TB per month
- Mounts connect Amazon S3, Azure Blob, Google Cloud Storage, SharePoint, an on-premises NAS and other servers
- For each mount, Files.com stores the username, password, key or token, encrypted
- On-premises storage is reached through the Files.com Agent, which connects outbound only
SFTP.cloud
Your storage. Nothing else.
Files stream through a Storage Connector you run next to your storage. They are never written to a disk we own.
- We hold no access key, secret key, OAuth refresh token or service principal, and you never grant us a cross-account role
- Your Connector authenticates to your storage with credentials you created and stored where you chose. Rotate them without telling us
- The Connector only dials out, so there is no inbound rule to your network
- Optional encryption at rest with a key that lives on your Connector and is never sent to us
A credential stored encrypted still exists outside your network. With SFTP.cloud, it never does.
02Encryption in transit
Traffic captured today stays unreadable tomorrow.
An attacker can record encrypted transfers now and keep them until a quantum computer can break classical key exchange. Post-quantum key exchange closes that window for files that must stay confidential for years.
| Connection | Files.com, published defaults | SFTP.cloud |
|---|---|---|
| SFTP key exchange | curve25519, curve448 and Diffie-Hellman groups. No post-quantum algorithm listed. | Hybrid post-quantum mlkem768x25519-sha256 |
| HTTPS key exchange | TLS 1.3 with x25519 | TLS 1.3 with hybrid post-quantum cipher suites |
| FTPS | TLS 1.2 by default, and the default list still includes two weak choices:Static RSA key exchange. No forward secrecy: anyone who later obtains the server's private key can decrypt every session they recorded.CBC mode. The mode behind padding-oracle attacks such as Lucky Thirteen. | TLS 1.3 with hybrid post-quantum cipher suites, on FTPS and FTPES |
Mutual TLS
Every component proves who it is, on every connection.
Encrypting the connection from your partner is only the outside layer. Inside SFTP.cloud, the Head, the control plane and your Connector authenticate each other with certificates and refuse any peer that can't. No component is trusted because of where it sits on a network.
- 01A foothold is not a way in.
An attacker who reaches the network between our components still can't pose as one of them without its certificate.
- 02No plaintext hop anywhere.
Every link between components is encrypted, not only the connection at the edge.
- 03Your Connector answers only to us.
It accepts instructions only from a control plane that proves its identity, so a forged server can't direct it at your storage.
Standard protocols, standard clients. Your partners connect with the software they already use. Nothing proprietary, nothing to install.
03Audit trail
A record you can check without taking our word for it.
Both products keep an audit trail that nobody can edit. The difference is who holds it, and whether you can prove it is intact without relying on that party.
Files.com
One record, held by Files.com.
A single audit log of your site, stored by Files.com in write-once-read-many format.
- Records every login, file event, permission change, protocol session and setting change
- Entries cannot be edited or deleted by anyone, including site administrators
- Kept for 7+ years
- Streams to Splunk, Sentinel, Datadog or any SIEM
SFTP.cloud
Two signed records, held by two parties.
Your Connector and our Head each keep their own record of every session, on machines owned by different parties. Neither side can quietly bring the other's record into line with its own.
- Your Connector records every file operation, allowed and denied, signed with a key that never leaves it
- Every line is chained to the one before it, so a changed, removed or reordered line breaks the chain
- Every five minutes a signed commitment leaves the machine and is countersigned on arrival. From then on, not even the machine's owner can rewrite that period undetected
- Download the evidence file and check it with logverify, an open-source verifier that needs nothing from us
A log only one party holds asks you to trust that party. Two signed records let you check it yourself.
04Shield
Attackers are turned away before the handshake.
Shield watches every source address for failed sign-ins and remembers how each one behaved. A fast brute-force attempt is caught quickly, and so is a botnet that spreads its guesses thin so that no single address stands out.
Once an address is banned, its connections are refused at TCP accept, before any SSH or TLS key exchange begins. Turning away an attack costs almost nothing, so your legitimate users keep signing in while it is underway.
Shield is deterministic, so false positives are rare, and it is on for every SFTP.cloud endpoint from the first day.
A real attack
6 September 2026, less than two hours after SFTP.cloud opened for early access.
05Side by side
Plans, storage and protocols, line by line.
Checked on 15 October 2026
| Files.com | SFTP.cloud | |
|---|---|---|
| Plans and price | ||
| Entry plan | Starter: $199 a month, or $2,099 a year | Shared: $240 a month, or $2,400 a year |
| Next plan | Power: $499 a month, or $5,269 a year | Dedicated: $840 a month, or $8,400 a year, on your own VM |
| Accounts on the entry plan | 10 Full Users and 50 System Users | 15 transfer accounts and 3 Storage Connectors |
| Usage charges | Starter includes 1 TB of monthly storage and transfer, then $100 per TB per month | No per-gigabyte or transfer charge |
| Free trial | 7 days, no credit card | 14 days, no credit card |
| Storage | ||
| Default storage | Files.com storage | Your storage only |
| Your own cloud storage | Yes, as Remote Server Mounts | Yes: Amazon S3, Azure Blob, Google Cloud Storage and S3-compatible stores |
| On-premises storage | Through the Files.com Agent, outbound only | Through your Storage Connector, outbound only |
| Credentials to your storage | Stored by Files.com, encrypted | Stay on your Connector |
| Sharing | ||
| Share links for people without an account | Share Links, on every plan | Shares, on every plan, each with a password, expiry, allowed IP addresses and an access limit, within a policy your administrator sets |
| Protocols and encryption | ||
| Protocols | SFTP, FTP, FTPS, WebDAV and a web app | SFTP, FTPS, FTPES and an HTTPS web client |
| Post-quantum key exchange | Not in the published SFTP or HTTPS defaults | SFTP, FTPS, FTPES and HTTPS |
Files.com information comes from the Files.com website and public documentation as of the date above and may have changed since. Prices exclude taxes. Files.com is a trademark of its owner. SFTP.cloud is not affiliated with or endorsed by Files.com.
06Choosing
When Files.com is the better fit.
The two products overlap, but they are not built for the same buyer. In these cases, Files.com is the more direct choice.
- 01
You want the vendor to store your files.
Every Files.com plan includes storage. SFTP.cloud has none of its own: it only works with storage you already run.
- 02
You want built-in workflows without writing scripts.
Files.com includes Automations, Sync Flows and Inboxes as ready-made features. SFTP.cloud automates with SyncJS scripts, which take more setup and give you more control.
- 03
You need a FedRAMP security mode.
Files.com documents a FedRAMP Security Mode setting that locks its cipher configuration.
If your files must stay in storage you control, and no one else may hold the keys to it, that is what SFTP.cloud is built for.
07FAQ
SFTP.cloud and Files.com, common questions.
Is SFTP.cloud an alternative to Files.com?
For SFTP, FTPS and web access in front of your own storage, yes. SFTP.cloud gives your partners the same standard protocols, while your files stay in your storage and the credentials to it stay on your Storage Connector.
Can Files.com use my own storage?
Yes. Files.com Remote Server Mounts connect storage such as Amazon S3, Azure Blob, Google Cloud Storage and on-premises servers. For each mount, Files.com stores the username, password, key or token it uses, encrypted.
Does SFTP.cloud store my files or my storage credentials?
No. Files stream through the Storage Connector you run next to your storage and are never written to a disk we own. The Connector authenticates to your storage with credentials that never leave it.
Does Files.com support post-quantum key exchange for SFTP?
As of 15 October 2026, the default SFTP key exchange algorithms in the Files.com documentation do not include a post-quantum algorithm. SFTP.cloud negotiates the hybrid post-quantum mlkem768x25519-sha256 for SFTP, and post-quantum cipher suites for FTPS, FTPES and HTTPS.
How do the prices compare?
Files.com Starter is listed at $199 a month or $2,099 a year, and includes 1 TB of monthly storage and transfer. SFTP.cloud Shared is $240 a month or $2,400 a year, with no per-gigabyte or transfer charge. Your storage provider bills your storage as usual.
Will my partners need new software?
No. SFTP.cloud uses standard SFTP, FTPS and FTPES, so your partners connect with the clients they already use, or with the browser-based web client.
Keep your files. Keep your keys.
Connect your own storage, invite a partner and send your first file. Fourteen days, no credit card, and nothing to cancel if it is not for you.
Want the details first? Read about security or how it works.