SFTP.cloud vs GoAnywhere MFT
GoAnywhere keeps your files. SFTP.cloud never has them.
Both give your partners SFTP, FTPS and HTTPS. GoAnywhere MFT runs on a server you license and patch, and it holds what your partners send. SFTP.cloud streams it straight into storage you own, so a breach of the transfer service finds nothing of yours to take.
GoAnywhere details checked against Fortra product pages and public security advisories on 15 October 2026.
Where your files are kept
On the GoAnywhere server or storage it manages
Only in your storage
Who runs and patches the server
You, for self-hosted GoAnywhere
We do
Price
Quote only
Published, from $2,400 a year
01The public record
What a vulnerability reaches depends on what the server holds.
Every product ships vulnerabilities, ours included. What matters is what an attacker reaches once in. These are public advisories for GoAnywhere MFT; Fortra released fixes for each.
January–February 2023CVE-2023-0669
Zero-day used by the Cl0p ransomware gang.
CISA and the FBI reported that Cl0p exploited this flaw from late January 2023 and claimed to have taken data from about 130 victims over ten days. They found no movement into victims' networks, suggesting the breach was limited to the GoAnywhere platform itself.
January 2024CVE-2024-0204
Authentication bypass that creates an administrator.
Rated critical, CVSS 9.8. An unauthenticated attacker could create an administrator account through the administration portal.
September 2025CVE-2025-10035
Maximum-severity flaw exploited before the advisory.
Rated CVSS 10.0. Microsoft reported that the group it tracks as Storm-1175 exploited it from 11 September 2025, a week before Fortra's advisory, and deployed Medusa ransomware in some of those networks.
With SFTP.cloud, the same class of flaw finds no files. They are never written to a disk we own, and we hold no credentials to the storage where they are.
How our security works02Files and credentials
One stores your files. The other passes them through.
GoAnywhere is built around a server that keeps what your partners send. SFTP.cloud is built so that the service your partners connect to never holds a copy.
GoAnywhere MFT
Files land on the GoAnywhere server.
GoAnywhere MFT is software licensed per server instance. You run it on premises or in AWS or Azure, or Fortra hosts it for you as MFTaaS.
- Partners connect to the GoAnywhere server, and their files are stored there or in storage it manages
- An optional DMZ Secure Gateway can keep the server off the internet, as a separate component to deploy
- Fortra advises not exposing the Admin Console directly to the internet, which is yours to enforce
- Self-hosted instances are yours to patch, often against a deadline set by an active exploit
SFTP.cloud
Your storage. Nothing else.
Files stream through a Storage Connector you run next to your storage. They are never written to a disk we own.
- We hold no access key, secret key, OAuth refresh token or service principal, and you never grant us a cross-account role
- Your Connector authenticates to your storage with credentials you created and stored where you chose. Rotate them without telling us
- The Connector only dials out, so there is no inbound rule to your network
- We run and patch the transfer service your partners connect to
An encrypted file on a breached server is still on that server. With SFTP.cloud, there is no file on ours.
03Defences
What stands between an attacker and your storage.
Keeping your files off our servers removes the prize. These four layers make the service itself hard to attack, and every SFTP.cloud plan includes all of them.
- 01
Shield turns attackers away before the handshake.
Shield remembers how every source address behaves and catches fast brute-force attempts and slow, spread-out botnets alike. Banned sources are dropped at TCP accept, before any SSH or TLS key exchange begins.
- 02
Post-quantum key exchange on every protocol.
SFTP negotiates the hybrid
mlkem768x25519-sha256, and FTPS, FTPES and HTTPS use post-quantum cipher suites, so traffic recorded today stays unreadable later. - 03
Mutual TLS between every component.
The Head, the control plane and your Connector authenticate each other with certificates on every connection. A foothold on the network between them is not a way in.
- 04
Two signed audit records you can check yourself.
Your Connector and our Head each keep a signed, chained record of every session. Download the evidence file and verify it with logverify, an open-source tool that needs nothing from us.
If we are breached, you are not.
04Side by side
Running it, storage and protocols, line by line.
Checked on 15 October 2026
| GoAnywhere MFT | SFTP.cloud | |
|---|---|---|
| Running it | ||
| How it is delivered | Software licensed per server instance, run on premises or in AWS or Azure, or hosted by Fortra as MFTaaS | A managed service, with a Storage Connector you run next to your storage |
| Who patches the transfer server | You, for self-hosted instances | We do |
| Price | Quote only, sold in bundles and modules | Published: Shared $2,400 a year, Dedicated $8,400 a year |
| Storage | ||
| Where files are kept | On the GoAnywhere server or storage it manages | Only your storage |
| Keeping the server off the internet | An optional DMZ Secure Gateway you deploy | Your Connector only dials out; there is no server of yours on the internet |
| Protocols and automation | ||
| Protocols | SFTP, FTPS, HTTPS, AS2 and more | SFTP, FTPS, FTPES and an HTTPS web client |
| Workflow automation | Advanced Workflows module | SyncJS scripting, included |
GoAnywhere information comes from Fortra product pages and public security advisories as of the date above and may have changed since. Prices exclude taxes. Fortra and GoAnywhere are trademarks of Fortra, LLC. SFTP.cloud is not affiliated with or endorsed by Fortra.
05Choosing
When GoAnywhere is the better fit.
The two products overlap, but they are built for different situations. In these cases, GoAnywhere is the more direct choice.
- 01
You must run the transfer server yourself.
GoAnywhere installs on your own servers, including IBM i, inside your own network. SFTP.cloud's transfer service always runs on infrastructure we operate.
- 02
You need AS2, EDI translation or secure email.
GoAnywhere offers these as modules. SFTP.cloud supports SFTP, FTPS, FTPES and HTTPS, and does not do AS2 or EDI.
- 03
You want transfer workflows without scripting.
GoAnywhere's Advanced Workflows module builds them without code. SFTP.cloud automates with SyncJS scripts, which take more setup and give you more control.
If your files must stay in storage you control, and the transfer service must never hold them, that is what SFTP.cloud is built for.
06FAQ
SFTP.cloud and GoAnywhere MFT, common questions.
Is SFTP.cloud an alternative to GoAnywhere MFT?
For SFTP, FTPS and web file transfer with your partners, yes. The difference is architecture: GoAnywhere runs on a server that holds the files it receives, while SFTP.cloud streams them into storage you own and never keeps a copy.
What happened with GoAnywhere in 2023?
From late January 2023, the Cl0p ransomware gang exploited a zero-day in GoAnywhere MFT, CVE-2023-0669, and claimed to have taken data from about 130 victims. CISA and the FBI described it in a joint advisory. Fortra released a fix.
What is CVE-2025-10035?
A maximum-severity flaw in the GoAnywhere MFT License Servlet, rated CVSS 10.0. Microsoft reported that a group it tracks as Storm-1175 exploited it from 11 September 2025, before Fortra published its advisory on 18 September, and deployed Medusa ransomware in some networks.
Does SFTP.cloud store my files or my storage credentials?
No. Files stream through the Storage Connector you run next to your storage and are never written to a disk we own. The Connector authenticates to your storage with credentials that never leave it.
Do I have to install or patch a transfer server?
No. We run and patch the transfer service your partners connect to. You run a Storage Connector next to your storage, and it only makes outbound connections.
How is SFTP.cloud priced?
Prices are published. Shared is $2,400 a year with 15 transfer accounts and 3 Storage Connectors included, and Dedicated, on your own VM, is $8,400 a year. There is no per-gigabyte or transfer charge. GoAnywhere pricing is quoted on request.
Your files, never on our servers.
Connect your own storage, invite a partner and send your first file. No server to install or patch. Fourteen days, no credit card, and nothing to cancel if it is not for you.
Want the details first? Read about security or how it works.