SFTP for Google Cloud Storage

SFTP for Google Cloud, with nothing exposed.

Google Cloud has no managed SFTP service. SFTP.cloud gives your partners SFTP, FTPS and HTTPS access to your Cloud Storage buckets, with no SFTP server of your own to maintain and nothing in your project open to the internet.

Your objects stay in your project. We never store a copy, and we never hold a service account key or any other credential that can reach your bucket.

Start your free trial See how it works

14 days. No credit card. No feature locks.

Path of one uploadPartner to bucket
1Your partner's clientWinSCP, FileZilla, OpenSSH, a script or a browser. Nothing new to install.
2SFTP.cloudAuthenticates the user and applies policy. Stores nothing.
Your Google Cloud project
3Your Storage ConnectorIn your VPC, next to the bucket. Dials out, never accepts inbound.
4Your Cloud Storage bucketUnchanged. Same bucket, same storage classes, same lifecycle rules.

Inbound firewall rules in your VPC0

01The gap

AWS and Azure have managed SFTP. Google Cloud doesn't.

Storage Transfer Service is useful for moving data between storage systems in batches, but it is not an SFTP server and gives a trading partner nowhere to connect. That usually leaves two options, and neither is appealing.

Option 1

Run your own SFTP server on Compute Engine.

  • A VM, an OS and sshd to patch for as long as it runs
  • A public endpoint you defend yourself
  • Users, keys, audit logs and failover to build and maintain
  • A FUSE mount or sync job between the disk and the bucket

Option 2

Give your bucket credentials to a third party.

  • A service account key or HMAC key stored in someone else's infrastructure
  • Files often staged on their disks on the way through
  • A breach on their side becomes access to your bucket

Option 3

SFTP.cloud, with a Connector in your project.

  • No SFTP server to maintain, no sshd to configure, no public endpoint of your own
  • No credentials on our side; the Connector authenticates from inside your project
  • Files are never written to a disk we own
  • SFTP, FTPS, FTPES and an HTTPS web client on the same plan
From $2,400 a year, no per-GB charge

02How it works

A third option. One small Connector next to your bucket.

  1. 01

    Deploy a Storage Connector in your project.

    As a container or a small VM, usually in the same region as your bucket.

  2. 02

    It reaches Cloud Storage with a service account you own.

    You create it and scope it to the buckets you choose. Its credentials never leave your project.

  3. 03

    Your partners connect to SFTP.cloud.

    Over SFTP, FTPS, FTPES or HTTPS, with the clients they already have. Files stream through the Connector's outbound channel and are never written to a disk we own.

Runs on
Compute Engine or GKE. Anything that runs a container or a Linux or Windows service.
Network
Outbound connections only. Your VPC firewall stays closed inbound.
Region
Place it in the bucket's region so traffic between the two stays in one location.
Objects
Stored as ordinary objects. Storage classes, lifecycle rules, versioning and retention policies keep working.
gcloudScoped to one bucket
gcloud storage buckets \
  add-iam-policy-binding \
  gs://partner-exchange \
  --member="serviceAccount:sftp-connector@\
<project>.iam.gserviceaccount.com" \
  --role="roles/storage.objectUser"
Grant the Connector's service account access to one bucket, and nothing else in the project. Use roles/storage.objectViewer for read-only access. On Compute Engine or GKE, attach the service account directly and there is no key file at all.

03Security

We never hold your service account key.

Nothing in our infrastructure can reach your bucket, so nothing in our infrastructure could be stolen and used against it.

  • 0Service account keys
  • 0HMAC keys or OAuth tokens
  • 0Delegated identities in our project
  • 01

    Credentials stay in your project.

    The Connector authenticates from inside your project with a service account you created. It is never sent to us, and we have no way to ask for it.

  • 02

    Rotate or revoke whenever you like.

    Change the service account's roles or keys on your own schedule. You don't need to tell us, and nothing on our side notices.

  • 03

    Optional encryption of the objects themselves.

    Encrypt with a key that lives on your Connector and that we never receive. Anyone who reaches the bucket by another route finds only ciphertext. How we're built

04What you get

Everything in the product, on top of the bucket you already have.

05FAQ

SFTP and Google Cloud Storage, common questions.

Does Google Cloud have a managed SFTP service?

No. AWS has Transfer Family and Azure has native SFTP for Blob Storage, but Google Cloud has no managed SFTP server for Cloud Storage. The usual workarounds are running your own server on Compute Engine or giving bucket credentials to a third party.

Can Storage Transfer Service act as an SFTP server?

No. Storage Transfer Service moves data between storage systems in scheduled batches. It does not accept incoming SFTP connections, so a trading partner has nowhere to connect.

Do I need to create a service account key?

No. On Compute Engine or GKE you attach the service account to the Connector directly, so no key file exists. Whichever way you authenticate, the credential stays in your project and never reaches us.

Which IAM role does the Connector need?

For read and write access, Storage Object User (roles/storage.objectUser) on the bucket is enough. Use Storage Object Viewer for read-only access. You can grant either on a single bucket rather than the whole project.

Does SFTP.cloud store copies of my files?

No. Files stream through the Storage Connector in your project, directly to and from your bucket. They are never written to a disk we own.

What does it cost?

From $2,400 a year on the Shared plan, with 15 transfer accounts and 3 Storage Connectors included, and no per-gigabyte or per-hour charge. Google Cloud still bills your storage, operations and network egress as usual.

Point it at a bucket and try it today.

Deploy a Connector, grant its service account access to one bucket and send your first file in an afternoon. Fourteen days, no credit card, and nothing to cancel if it is not for you.

Start your free trial

Want to see the moving parts first? See how it works or talk to an engineer. The person who answers builds the product.