Field notes, deep dives, and how-tos on SFTP, FTPS, WebDAV, and secure file transfer engineering. Updated weekly.
Hard quotas reject the upload mid-transfer. Soft quotas let it through but log a warning. What each mode does, how to configure them in one XML element, and what your users actually see when they hit the wall.
Read article ›SFTP is the default for good reason. But legacy trading partners, regulatory submission gateways, and TLS-inspection firewalls create real scenarios where FTPS is the right protocol. When to pick it, what you give up, and what the configuration looks like.
Read article ›A composite scenario: how a regional hospital network replaces a shared network drive with encrypted SFTP, mandatory MFA, and a complete audit trail that satisfies every HIPAA technical safeguard.
Read article ›How the database storage backend splits files into 4 MB chunks, shares them across copies with reference counting, and cleans up orphans on delete. The internals behind the User’s Guide chapter.
Read article ›How SFTP public-key authentication works from key generation through distribution to rotation. What the server stores, how it verifies, and what each key type means.
Read article ›When your SFTP server stores files in a database, backup collapses from two problems into one. What to back up, how the built-in upgrade safety net works, and what to test before you need the restore.
Read article ›Audit log retention is not one number. HIPAA, PCI DSS, SOX, and GDPR each set different floors — and GDPR flips the question entirely. What each framework requires, what that means for storage, and a practical tiered schedule.
Read article ›Two XML elements, one database file, and every connection from the wrong continent is refused before the SSH handshake even starts. Allow mode or deny mode, MaxMind or CSV, hot-reload without restart.
Read article ›How the server reads the user’s AD group membership at every login and decides read-write, read-only, or default access — two XML elements, no scripts, no sync jobs.
Read article ›We kept our release notes in three hand-written copies, and they drifted — of course they did. Now one XML document generates the web page, the installer's FIXES.txt, and the update feed our servers read — and our first-ever phone-home sends nothing at all, because the feed is just the release notes.
Read article ›Seven polling timers kept the consoles fresh-ish. All of them are gone: every surface now updates by server push. The signal-then-refetch design, why a storm must cost one signal, watching folders nobody uploads through — and the caching bug that made 21 ms look like 30 seconds.
Read article ›Guarding the MCP tools leaves a side door open — the assistant already holds a token for the ordinary REST API. Why the block is enforced by credential type rather than tool name, and an honest account of the one case no server can cover.
Read article ›A thousand users is not a thousand transfers. Capacity planning grounded in the server's actual internals — NIO threading, bounded queues and caches, staging-volume math, and the quota arithmetic that sizes your disk.
Read article ›The Knowledge Base inside Stylus SFTP Server has a native MCP server. We let an AI assistant author a complete partner knowledge base through it — OAuth sign-in, drafts-first, tenant walls intact — and the git-backed history labeled every revision it made.
Read article ›One upload event, delivered simultaneously to the database, your SIEM over RFC 5424 syslog, a signed webhook, and an email threshold rule. What each sink actually emits, and the single config block that turns them all on.
Read article ›ATOMIC_MOVE is the difference between a downstream job seeing a whole file and seeing half of one. Here is what it guarantees, why it only holds within a single filesystem, and what happens when staging and target live on different volumes.
Read article ›Step-by-step walkthrough of enabling TOTP multi-factor authentication on Stylus SFTP Server and enrolling users through the Web File Portal.
Read article ›Most SFTP servers write directly to the target file. That means downstream consumers see partial writes. Here is how atomic staging, ATOMIC_MOVE, and a configurable rename pattern eliminate the problem.
Read article ›The Activities tab shows three charts that refresh every ten seconds. Each line is sourced from a different place in the server and answers a different operational question. Here is what they measure and what a spike means.
Read article ›A war story from our own test bench. 92% of the way through a 9 GB upload, the disk filled up — not with the file, but with the database's record of how to undo writing the file. Here is the autopsy.
Read article ›A walkthrough of how the same credential leak plays out on a password-only SFTP listener versus one with MFA enabled. The asymmetry is large; the design choice is cheap.
Read article ›An AI agent writes this blog every week and publishes it to production. Its only credential is one SFTP login. Here is why that turned out to be the right boundary — and what the deployment actually looks like.
Read article ›Most SFTP servers put files on disk. Some of them really shouldn't. Here's when a database-backed storage layer wins on operations, what it costs, and what we built when we shipped one.
Read article ›One post per week. Watch this space — or come back the same time each Tuesday.
Free evaluation key, full feature set, install in minutes — SFTP, FTPS, WebDAV, browser portal, and audit out of the box.
