SFTP.cloud vs Kiteworks
Kiteworks guards your files inside its appliance. We never have them to guard.
Both give your partners SFTP and FTPS. Kiteworks is a content platform for email, file sharing, forms and file transfer, and every file you exchange is stored inside its appliance, on your servers or on Kiteworks’. When that appliance is attacked, your files are what it holds. SFTP.cloud streams each file straight into storage you own and never keeps a copy.
Kiteworks details checked against Kiteworks documentation and public security reporting on 16 October 2026.
What you are buying
A content platform for email, file sharing, forms and MFT
Managed SFTP, FTPS and HTTPS
Who holds your files
The Kiteworks appliance, on your servers or theirs
You do. We never store them
Price you can see up front
Quote only. SFTP is an add-on
Published, from $2,400 a year
01The public record
What a vulnerability reaches depends on what the server holds.
Every product may have vulnerabilities. Kiteworks fixed each of the flaws below and reported no evidence that the 2026 ones were exploited. What matters to you is what an attacker would have found: an appliance that stores the files you exchange.
25–28 September 2026Precautionary shutdown
Customers told to switch their servers off.
After a warning from federal intelligence authorities, Kiteworks advised a nine-hour shutdown of on-premises and customer-hosted systems. During the window it found a previously unknown critical flaw in Advanced Forms, enabled for fewer than 1% of customers, and fixed it. Your files were safe only while the appliance holding them was offline.
September 2026CVE-2026-54154
Root on the email gateway, without a login.
A maximum-severity chain in the Kiteworks Email Protection Gateway could let an unauthenticated attacker run code and take full root control of the appliance. It was fixed in version 9.4.1. BleepingComputer reported 11 more critical flaws in Core and the gateway fixed in the same release, including authentication bypass and admin account takeover.
December 2020–February 2021CVE-2021-27101
The Accellion FTA attacks.
Before it was renamed Kiteworks, Accellion’s legacy File Transfer Appliance was exploited through four zero-days. Fewer than 100 of about 300 FTA customers were hit. Accellion said the Kiteworks platform, a separate codebase, was not affected, and it retired FTA in April 2021.
With SFTP.cloud, the same class of flaw finds no files. They are never written to a disk we own, and we hold no credentials to the storage where they are.
How our security works02Who holds your files
Kiteworks stores the files. SFTP.cloud passes them through.
Kiteworks is built around a hardened virtual appliance that keeps every file you exchange, encrypted at rest. You choose where the appliance runs. SFTP.cloud is built so that the service your partners connect to never holds a copy.
Kiteworks
Your files live inside the appliance.
Kiteworks encrypts every file at rest with AES-256 inside its virtual appliance, which runs on your servers, in your cloud account, or hosted by Kiteworks.
- Self-hosted, you install and patch the appliance, as customers did during the September 2026 shutdown
- Kiteworks-hosted, Kiteworks runs the appliance that holds your files
- You can own the encryption keys, but the appliance uses them on every upload and download
- Connections to S3, Azure Blob, Google Cloud Storage and others are configured in Kiteworks
SFTP.cloud
Your storage. Nothing else.
Files stream through a Storage Connector you run next to your storage. They are never written to a disk we own.
- We hold no access key, secret key, OAuth refresh token or service principal, and you never grant us a cross-account role
- Your Connector authenticates to your storage with credentials you created and stored where you chose. Rotate them without telling us
- The Connector only dials out, so there is no inbound rule to your network
- We run and patch the transfer service your partners connect to
Owning the key does not change who holds the files. With SFTP.cloud, there is no copy to protect.
03Defences
What stands between an attacker and your storage.
Keeping your files off our servers removes the prize. These four layers make the service itself hard to attack, and every SFTP.cloud plan includes all of them.
- 01
Shield turns attackers away before the handshake.
Shield remembers how every source address behaves and catches fast brute-force attempts and slow, spread-out botnets alike. Banned sources are dropped at TCP accept, before any SSH or TLS key exchange begins.
- 02
Post-quantum key exchange on every protocol.
SFTP negotiates the hybrid
mlkem768x25519-sha256, and FTPS, FTPES and HTTPS use post-quantum cipher suites, so traffic recorded today stays unreadable later. - 03
Mutual TLS between every component.
The Head, the control plane and your Connector authenticate each other with certificates on every connection. A foothold on the network between them is not a way in.
- 04
Two signed audit records you can check yourself.
Your Connector and our Head each keep a signed, chained record of every session. Download the evidence file and verify it with logverify, an open-source tool that needs nothing from us.
If we are breached, you are not.
04Side by side
Running it, storage and protocols, line by line.
Checked on 16 October 2026
| Kiteworks | SFTP.cloud | |
|---|---|---|
| Running it | ||
| What you are buying | A content platform covering email encryption, file sharing, web forms, DRM and MFT | A managed file transfer service for SFTP, FTPS, FTPES and HTTPS |
| How it is delivered | A virtual appliance on your servers or cloud account, or hosted by Kiteworks | A managed service, with a Storage Connector you run next to your storage |
| Who patches the next zero-day | You, for self-hosted appliances. Kiteworks, for hosted ones | We do |
| Price you can see up front | Quote only, not published. SFTP is sold as an add-on package | Published: Shared $2,400 a year, Dedicated $8,400 a year, SFTP included |
| Storage | ||
| Who holds your files | The Kiteworks appliance, encrypted at rest | Only your storage |
| Who holds the keys to your storage | Cloud storage connections are configured in Kiteworks | Only your Connector, with credentials that never leave it |
| What a compromised server exposes | The files stored in the appliance | No files. They are never written to a disk we own |
| Protocols and proof | ||
| Protocols | SFTP, FTPS, SMB, CIFS and AS2, plus HTTPS web access and APIs | SFTP, FTPS, FTPES and an HTTPS web client |
| Proof nobody altered the log | Audit logs inside the appliance | Two signed, chained records, verifiable with an open-source tool |
Kiteworks information comes from Kiteworks documentation and public security reporting as of the date above and may have changed since. Prices exclude taxes. Kiteworks is a trademark of Kiteworks, Inc. SFTP.cloud is not affiliated with or endorsed by Kiteworks.
05Choosing
When Kiteworks is the better fit.
Kiteworks covers far more than file transfer, and it holds your files to do it. If you need these parts, Kiteworks is the more direct choice. Each comes with a trade-off worth weighing.
- 01
You want email, file sharing and forms in one platform.
Kiteworks governs encrypted email, file sharing, web forms and MFT together. The trade-off is surface: in 2026 the shutdown traced to its forms product, and the worst flaw to its email gateway.
- 02
You need FedRAMP-authorized hosting.
Kiteworks has held FedRAMP Moderate authorization since 2017. The trade-off is that in hosted deployments, Kiteworks runs the appliance that stores your files.
- 03
Your network is air-gapped.
Kiteworks supports fully offline deployments. The trade-off is that you install, update and patch every appliance yourself, with no one else watching it.
For secure file transfer into storage you own, SFTP.cloud is the simpler and safer choice.
06FAQ
SFTP.cloud and Kiteworks, common questions.
Is SFTP.cloud an alternative to Kiteworks?
For SFTP, FTPS and web file transfer with your partners, yes. Kiteworks is a broader platform that also covers encrypted email, file sharing, web forms and digital rights management, and it keeps your files inside its appliance. If secure file transfer is what you need, SFTP.cloud streams each file into storage you own and never keeps a copy.
Was Kiteworks affected by the Accellion FTA breach?
No. The 2020 and 2021 attacks exploited Accellion’s legacy File Transfer Appliance, a separate product with a separate codebase. Accellion said the Kiteworks platform was not affected, ended FTA support on 30 April 2021 and renamed itself Kiteworks later that year.
Why did Kiteworks ask customers to shut down their servers in September 2026?
On 25 September 2026, after a warning from federal intelligence authorities, Kiteworks advised a nine-hour precautionary shutdown of on-premises and customer-hosted systems. It found and fixed a critical flaw in Advanced Forms, enabled for fewer than 1% of customers, and said it had no evidence of exploitation. Days later it published fixes for further flaws, including the maximum-severity CVE-2026-54154 in its Email Protection Gateway.
Kiteworks lets me own the encryption keys. Isn’t that enough?
Owning the keys protects files at rest. The appliance still stores your files and uses the keys on every upload and download, so whoever takes control of the appliance can reach what it serves. SFTP.cloud never stores your files, so there is nothing at rest on our side to protect.
Does SFTP.cloud store my files or my storage credentials?
No. Files stream through the Storage Connector you run next to your storage and are never written to a disk we own. The Connector authenticates to your storage with credentials that never leave it.
Do I have to install or patch a transfer server?
No. We run and patch the transfer service your partners connect to. You run a Storage Connector next to your storage, and it only makes outbound connections.
How is SFTP.cloud priced?
Prices are published. Shared is $2,400 a year with 15 transfer accounts and 3 Storage Connectors included, and Dedicated, on your own VM, is $8,400 a year. There is no per-gigabyte or transfer charge. Kiteworks does not publish prices on its website, and SFTP is sold as an add-on package.
Your files, never on our servers.
Connect your own storage, invite a partner and send your first file. No appliance to install or patch. Fourteen days, no credit card, and nothing to cancel if it is not for you.
Want the details first? Read about security or how it works.