SFTP.cloud vs MOVEit
MOVEit keeps your files. SFTP.cloud never has them.
Both give your partners SFTP, FTPS and HTTPS. MOVEit stores what they send on the transfer server. SFTP.cloud streams it straight into storage you own, so a breach of the transfer service finds nothing of yours to take.
MOVEit details checked against Progress documentation and public security advisories on 15 October 2026.
Where your files are kept
In MOVEit's filestore, encrypted
Only in your storage
Who runs and patches the server
You, for MOVEit Transfer
We do
Price
Quote only
Published, from $2,400 a year
01The public record
What a vulnerability reaches depends on what the server holds.
Every product may have vulnerabilities. The damage depends on what an attacker finds once they are in. These are public advisories for MOVEit Transfer.
May–June 2023CVE-2023-34362
SQL injection zero-day, exploited at scale.
From 27 May 2023 the Cl0p ransomware gang exploited a previously unknown flaw in MOVEit Transfer. CISA and the FBI reported that internet-facing servers were given a web shell, LEMURLOOT, which was used to steal data from the underlying MOVEit Transfer databases.
June 2024CVE-2024-5806
Authentication bypass in the SFTP module.
Rated critical, CVSS 9.1. Researchers found it affected the MOVEit Transfer SFTP service in its default configuration, given a valid username.
October 2025CVE-2025-10932
Resource exhaustion in the AS2 module.
Rated high, CVSS 8.2. Progress listed every MOVEit Transfer version as affected when it was disclosed.
With SFTP.cloud, the same class of flaw finds no files. They are never written to a disk we own, and we hold no credentials to the storage where they are.
How our security works02Files and credentials
One stores your files. The other passes them through.
MOVEit is built around a server that keeps what your partners send. SFTP.cloud is built so that the service your partners connect to never holds a copy.
MOVEit
Files are kept in MOVEit's filestore.
MOVEit Transfer encrypts each file it receives and stores it in its filestore. MOVEit Cloud is the version Progress hosts for you.
- The filestore sits on a local disk, a NAS or SAN, or Azure Blob Storage
- Users, settings and logs live in the MOVEit Transfer database
- An Azure Blob filestore connects with a storage account API key held by MOVEit Transfer
- MOVEit Transfer is software you install on your own Windows servers and patch yourself
SFTP.cloud
Your storage. Nothing else.
Files stream through a Storage Connector you run next to your storage. They are never written to a disk we own.
- We hold no access key, secret key, OAuth refresh token or service principal, and you never grant us a cross-account role
- Your Connector authenticates to your storage with credentials you created and stored where you chose. Rotate them without telling us
- The Connector only dials out, so there is no inbound rule to your network
- We run and patch the transfer service your partners connect to
An encrypted file on a breached server is still on that server. With SFTP.cloud, there is no file on ours.
03Defences
What stands between an attacker and your storage.
Keeping your files off our servers removes the prize. These four layers make the service itself hard to attack, and every SFTP.cloud plan includes all of them.
- 01
Shield turns attackers away before the handshake.
Shield remembers how every source address behaves and catches fast brute-force attempts and slow, spread-out botnets alike. Banned sources are dropped at TCP accept, before any SSH or TLS key exchange begins.
- 02
Post-quantum key exchange on every protocol.
SFTP negotiates the hybrid
mlkem768x25519-sha256, and FTPS, FTPES and HTTPS use post-quantum cipher suites, so traffic recorded today stays unreadable later. - 03
Mutual TLS between every component.
The Head, the control plane and your Connector authenticate each other with certificates on every connection. A foothold on the network between them is not a way in.
- 04
Two signed audit records you can check yourself.
Your Connector and our Head each keep a signed, chained record of every session. Download the evidence file and verify it with logverify, an open-source tool that needs nothing from us.
If we are breached, you are not.
04Side by side
Running it, storage and protocols, line by line.
Checked on 15 October 2026
| MOVEit | SFTP.cloud | |
|---|---|---|
| Running it | ||
| How it is delivered | MOVEit Transfer: software you install on your own Windows servers. MOVEit Cloud: hosted by Progress | A managed service, with a Storage Connector you run next to your storage |
| Who patches the transfer server | You, for MOVEit Transfer | We do |
| Price | Quote only, not published | Published: Shared $2,400 a year, Dedicated $8,400 a year |
| Storage | ||
| Where files are kept | MOVEit's filestore, encrypted | Only your storage |
| Credentials to your storage | Held by MOVEit Transfer, for example an Azure storage account API key | Stay on your Connector |
| Protocols and automation | ||
| Protocols | SFTP, FTPS, HTTPS and AS2 | SFTP, FTPS, FTPES and an HTTPS web client |
| Workflow automation | MOVEit Automation, a separate product | SyncJS scripting, included |
MOVEit information comes from Progress documentation and public security advisories as of the date above and may have changed since. Prices exclude taxes. Progress and MOVEit are trademarks of Progress Software Corporation. SFTP.cloud is not affiliated with or endorsed by Progress Software.
05Choosing
When MOVEit is the better fit.
The two products overlap, but they are built for different situations. In these cases, MOVEit is the more direct choice.
- 01
You must run the transfer server yourself.
MOVEit Transfer installs on your own servers, inside your own network. SFTP.cloud's transfer service always runs on infrastructure we operate.
- 02
Your partners send files over AS2.
MOVEit Transfer includes an AS2 module. SFTP.cloud supports SFTP, FTPS, FTPES and HTTPS, not AS2.
- 03
You want transfer workflows without scripting.
MOVEit Automation builds workflows without code. SFTP.cloud automates with SyncJS scripts, which take more setup and give you more control.
If your files must stay in storage you control, and the transfer service must never hold them, that is what SFTP.cloud is built for.
06FAQ
SFTP.cloud and MOVEit, common questions.
Is SFTP.cloud an alternative to MOVEit?
For SFTP, FTPS and web file transfer with your partners, yes. The difference is architecture: MOVEit stores the files it receives in its own filestore, while SFTP.cloud streams them into storage you own and never keeps a copy.
What happened with MOVEit in 2023?
From 27 May 2023, the Cl0p ransomware gang exploited a SQL injection vulnerability in MOVEit Transfer, CVE-2023-34362. CISA and the FBI reported that a web shell was used to steal data from the databases of internet-facing MOVEit Transfer servers. Progress released fixes.
Does SFTP.cloud store my files or my storage credentials?
No. Files stream through the Storage Connector you run next to your storage and are never written to a disk we own. The Connector authenticates to your storage with credentials that never leave it.
Do I have to install or patch a transfer server?
No. We run and patch the transfer service your partners connect to. You run a Storage Connector next to your storage, and it only makes outbound connections.
Does SFTP.cloud support AS2?
No. SFTP.cloud supports SFTP, FTPS, FTPES and an HTTPS web client. If your partners need AS2, MOVEit Transfer includes an AS2 module.
How is SFTP.cloud priced?
Prices are published. Shared is $2,400 a year with 15 transfer accounts and 3 Storage Connectors included, and Dedicated, on your own VM, is $8,400 a year. There is no per-gigabyte or transfer charge. MOVEit pricing is quoted on request.
Your files, never on our servers.
Connect your own storage, invite a partner and send your first file. No server to install or patch. Fourteen days, no credit card, and nothing to cancel if it is not for you.
Want the details first? Read about security or how it works.