On-premises storage

A cloud SFTP endpoint for files that never leave your building.

Your files live on a file server, a NAS or an SMB share. SFTP.cloud makes them reachable over SFTP, FTPS and HTTPS without moving them anywhere.

We run the public endpoint, the protocols, the users and the availability. You keep the files, on premises, where your policy already says they belong, with no inbound port opened to reach them.

Start your free trial See how it works

14 days. No credit card. No feature locks.

Path of one uploadPartner to your share
1Your partner's clientWinSCP, FileZilla, OpenSSH, a script or a browser. Nothing new to install.
2SFTP.cloudThe public endpoint. Managed, highly available, and stores nothing.
Your building
3Your Storage ConnectorOn a server, in Kubernetes or on your NAS. Dials out, never accepts inbound.
4Your file server, NAS or shareUnchanged. Same folders, same permissions, same backups.

Inbound ports opened in your firewall0

01The trade

Most hosted SFTP wants your data. This one doesn't.

Moving files to somebody's cloud just to make them reachable over SFTP is a large change, and it creates an attack surface you didn't have before. Running your own internet-facing server is the other usual answer, and it never stops needing attention.

Typical hosted SFTP

They run the server. Your files move to their cloud.

  • Someone else patches, monitors and keeps the server available
  • In exchange, your files are copied to their storage
  • A sync job between their cloud and your file server, or a second copy to keep in step
  • A new place your data can be breached, outside your control

SFTP.cloud

We run the endpoint. Your files stay where they are.

  • We operate the endpoint, protocols, users and availability
  • You keep the files on premises, never written to a disk we own
  • No inbound port, no DMZ, no change to your network perimeter
  • SFTP, FTPS, FTPES and an HTTPS web client on the same plan
From $2,400 a year, no per-GB charge

02How it works

Keep the files. Move the endpoint.

  1. 01

    Deploy a Storage Connector inside your network.

    On a server in your datacenter, as a container in Kubernetes, or on your NAS if it can run containers. Deploy more than one to reach storage in different networks.

  2. 02

    It dials out, and only out.

    The Connector opens its own connections to SFTP.cloud and keeps them open. Nothing on the internet can start a connection to it.

  3. 03

    Your partners connect to a managed cloud endpoint.

    Each file streams through the Connector in parallel chunks, straight to your storage, stored as it is or encrypted with a key that stays on the Connector.

Runs on
Windows or Linux servers, VMs, Docker, Kubernetes, or a NAS that runs containers.
Storage
Local disks, NAS, SAN, DFS, and anything you can mount over SMB/CIFS or NFS.
Performance
Each storage location on the Connector opens several outbound streams to the Head, so every upload and download moves in parallel chunks. A conventional SFTP server sends each file down a single stream.
Files
Land in your folders with your permissions, so backups, scans and downstream jobs keep working.
Your firewallEvery rule you need

Outbound

Connector → SFTP.cloud Portal, HTTPS 443Allow
Connector → your Head, TCP 7600Allow

Inbound

Internet → anything insideNone needed
Two outbound rules and nothing else. Nobody can get in through a connection your Connector opened.

03Your storage

Whatever you store files on today works as it is.

The Connector reads and writes your storage the way any server on your network would, with the permissions you give it.

  • 0Files moved to a cloud
  • 0Copies on disks we own
  • 0Inbound firewall rules
  • 01

    File servers and local disks.

    The Windows or Linux server that already holds the folders your partners need.

  • 02

    NAS, SAN and DFS.

    Network storage of any brand, and DFS namespaces that span several servers.

  • 03

    SMB/CIFS and NFS shares.

    Anything the Connector's host can mount, reached with the share permissions you set.

  • 04

    Optional encryption at rest.

    Store files encrypted with a key that never leaves the Connector. Anyone who reaches the share by another route finds only ciphertext.

  • 05

    Automation inside your network.

    SyncJS scripts run on the Connector before and after each operation, next to your files.

  • 06

    Credentials stay with you.

    Share credentials live on the Connector. They are never sent to us. How we're built

04What you get

Everything in the product, in front of the storage you already have.

05FAQ

SFTP for on-premises storage, common questions.

Do my files leave my network?

Only when a partner downloads them. Files stream through the Storage Connector between your storage and the partner, and are never written to a disk we own. Nothing is copied to a cloud in between.

Which firewall rules do I need?

Two outbound rules: from the Connector to the SFTP.cloud Portal on HTTPS port 443, and from the Connector to your SFTP.cloud Head on TCP port 7600. No inbound rule, no DMZ and no port forwarding.

What storage can I connect?

Local disks, file servers, NAS, SAN and DFS, and anything the Connector’s host can mount over SMB/CIFS or NFS.

Where does the Connector run?

On a Windows or Linux server or VM in your network, as a container in Docker or Kubernetes, or on a NAS that can run containers.

Is it slower than a server in my own building?

Usually it is faster. Each storage location on the Connector keeps several outbound streams open to your SFTP.cloud Head, so every upload and download is split into chunks that travel in parallel. A conventional SFTP server moves each file over a single stream.

What does it cost?

From $2,400 a year on the Shared plan, with 15 transfer accounts and 3 Storage Connectors included, and no per-gigabyte charge.

Point it at a share and try it today.

Install a Connector next to your storage, add two outbound rules and send your first file in an afternoon. Fourteen days, no credit card, and nothing to cancel if it is not for you.

Start your free trial

Want to see the moving parts first? See how it works or talk to an engineer. The person who answers builds the product.