A complete platform for secure file transfer — 5 protocols, database filesystem, and enterprise-grade compliance.
Run five access protocols plus the built-in Knowledge Base from a single installation, with shared authentication, quotas, and audit trail.
| Capability | SFTP | FTPS (Explicit) | FTPS (Implicit) | WebDAV | Web Portal | Knowledge |
|---|---|---|---|---|---|---|
| Default port | 22 | 21 | 990 | 9980 | 9980 | 9980 |
| Encryption | SSH tunnel | AUTH TLS upgrade | TLS from connect | HTTPS (TLS) | HTTPS (TLS) | HTTPS (TLS) |
| Post-quantum key exchange | Yes (ML-KEM) | — | — | — | — | — |
| Public key auth | Yes | — | — | — | — | — |
| MFA (TOTP) | Yes | — | — | — | Yes | Yes |
| Shared user database | Yes | Yes | Yes | Yes | Yes | Yes |
| Per-user quotas | Yes | Yes | Yes | Yes | Yes | — |
| Audit trail | Yes | Yes | Yes | Yes | Yes | Yes |
| Mount as drive | — | — | — | Yes | — | — |
| No client software | — | — | — | Yes | Yes | Yes |
Connect your existing user directory in minutes. One provider is active at a time — switch by changing a single element in the configuration.
Bind directly to your AD domain. Access rights are derived from group membership — no per-user setup on the server.
Store user accounts in an SQL database. Ships with H2 embedded — upgrade to MySQL, PostgreSQL, or SQL Server at any time.
TOTP (RFC 6238) second factor across every interface — SFTP keyboard-interactive, web portal, and admin console.
Multiple layers of protection ensure only authorized users access your data.
Block malicious traffic before authentication even begins.
Connection → GeoIP check
→ IP block list
→ Rate limiter
→ SSH handshake
→ Authentication
→ Lockout check
→ MFA verification
→ Session granted
Secure defaults with configurable algorithm suites.
Full certificate lifecycle from the admin console.
Users are confined to their home directory with no escape.
Store files directly in SQL for unified access, zero-copy duplication, and simplified backups — no shared network storage required.
The database filesystem stores files and folders with full hierarchical structure. Every protocol — SFTP, FTP, FTPS, WebDAV, and the web portal — sees the same directory tree.
Copy-on-write means duplicating a file is instant and costs zero additional storage until the copy is modified. Ideal for template distribution and file staging workflows.
H2 Embedded, zero-config default
MySQL Driver downloaded at config time
PostgreSQL Driver downloaded at config time
SQL Server Driver downloaded at config time
Schema auto-created on first boot.
Same files visible across all 5 protocols.
Backup = database backup. No file sync.
Four parallel audit sinks capture 15+ event types. Forward to your SIEM, trigger email alerts, or call webhooks in real time.
Full audit trail in sftp_audit with async queue (10,000 capacity). Searchable from the web admin console.
RFC 5424 structured data over UDP. Send events directly to Splunk, Elastic, Graylog, or any SIEM platform.
HTTP POST to any endpoint. Requests are signed with HMAC-SHA256 for tamper-proof delivery verification.
Simple, threshold, and batch notification rules. Powered by SMTP with STARTTLS support.
Per-folder retention policies that automatically delete aged files, with a 24-hour grace bin so a mistake never costs you data. Read more ›
Four dimensions plus a master toggle on every Virtual Folder: days, created-vs-modified anchor, recursive-vs-root scope, and an optional regex.
Deletion is a two-step move-then-reap. A staged file waits 24 hours; an admin can Restore or Delete Now at any time in the window.
See every staged file across every VD, sorted by urgency, with a red-amber-grey countdown column. Filter to items reaping within N hours.
Fire a tick immediately without disturbing the schedule. Every action — policy edit, stage, restore, reap — goes through the audit trail.
Per-user bandwidth, transfer events, and session counts — three live charts in the Web Admin's Activities tab, no extra monitoring stack required. Read more ›
Bytes per second per user at 5-second resolution. Y-axis auto-scales between B/s, KB/s, and MB/s.
Range (Last hour / 24h / 7d / 30d) and user filters drive all three charts. Auto-refresh every 10 seconds.
One AtomicLong increment per chunk transfer — about ten nanoseconds. Below measurement noise on the throughput path.
Raw 5-second samples roll up to 1-hour aggregates after 24 hours and age out at 30 days. ~1 MB per active user, steady state.
Every virtual folder's backing path is verified at startup and every five minutes — or on demand with the Check Folders button. A broken mount shows MISSING within minutes, and every change is recorded in the audit trail.
Give end users a familiar browser interface for uploading and downloading files — no client software, no training required.
Users log in with the same credentials as SFTP and see their home directory. Drag files onto the page to upload, click to download, or select a folder to download as a ZIP archive.
A color-coded quota bar shows remaining storage. Read-only users can browse and download but cannot upload or modify files. MFA enrollment is available from the portal settings page.
GET /portal/api/files?path=/
GET /portal/api/files/tree
POST /portal/api/upload?path=/
GET /portal/api/download?path=/report.pdf
GET /portal/api/download-zip?path=/archive
POST /portal/api/mkdir?path=/new-folder
DEL /portal/api/delete?path=/old-file.tmp
POST /portal/api/rename
POST /portal/api/copy
POST /portal/api/move
GET /portal/api/quota
GET /portal/api/mfa/status
POST /portal/api/mfa/enroll
Publish onboarding guides, file specs, and runbooks next to the folders your partners use — walled per organization, versioned like code. Read more ›
The Knowledge Base speaks the Model Context Protocol, so assistants like Claude search, read, and author your content through typed tools — gated by the same per-organization ACL as everyone else. Sign-in is OAuth 2.1 (browser login with SFTP credentials, MFA and PKCE enforced), scoped read-only or read-write per token, and every AI edit is tagged in the page history.
Topic tree plus a browser editor with styled tables, CSV import/export, images, attachments, and syntax-colored code snippets.
A full draw.io diagram editor opens inside the page. Diagrams render as images for readers and stay editable forever.
Topic visibility is granted to groups, so each customer organization sees its own manual — enforced server-side in the tree, pages, search, and attachments.
Every save is a version. Compare any version side by side with the current page, click a change to jump to it, and roll back safely.
Access your file transfer space as a mapped drive from Windows Explorer, macOS Finder, or any WebDAV client — no dedicated software required.
WebDAV lets users interact with their SFTP home directory as if it were a local drive. Open, edit, and save files directly from desktop applications like Microsoft Office.
On the database filesystem backend, copy and move operations execute server-side as instant SQL operations — no data transfer over the network.
# Windows — Map Network Drive
net use Z: https://server:443/webdav
# macOS — Finder
Connect to Server → https://server/webdav
# Linux — mount
mount -t davfs https://server/webdav /mnt/dav
Shared auth, quotas, and audit
with SFTP, FTPS, and Portal.
Every management task is available from the command line, the desktop GUI, and the web console — in full parity.
61 commands for scripting, automation, and headless servers. Pipe-friendly output for integration with monitoring tools.
11-tab admin panel with real-time server status, user management, audit viewer, session monitor, and certificate management.
Browser-based admin console on port 9980. 60+ REST API endpoints. No Java on the admin workstation required.
One installer, two platforms. Bundled Java 21 runtime means zero prerequisites.
The SFTP handshake defaults to mlkem768x25519-sha256 — a hybrid key exchange whose session key stays secret even against a future quantum computer. Here is what that claim actually means.
An attacker needs no quantum computer today to threaten today's data — they record your encrypted sessions now and store them. The classical key exchanges behind almost all internet traffic (X25519, ECDH, RSA, Diffie‑Hellman) all fall to Shor's algorithm once a large quantum computer exists, and every recorded session becomes readable in retrospect. For data with a long confidentiality life — financial, health, legal — that risk is present now.
The default mlkem768x25519-sha256 derives the session key from two exchanges at once: ML‑KEM‑768, the lattice-based algorithm NIST standardized as FIPS 203 (2024, from CRYSTALS‑Kyber), and X25519, the proven classical curve. The secret combines both, so it holds unless an attacker breaks both — today's battle-tested security and quantum resistance, even if the newer algorithm is later found wanting.
It is negotiated automatically in the SSH handshake: OpenSSH 9.x and recent PuTTY and WinSCP use it transparently, while older clients fall back to a strong classical exchange. Tune the full allow-list in sftp-server.xml — SNTRUP‑761 and ML‑KEM‑1024 hybrids ship too. It applies to the SSH-based SFTP surface and is powered by Bouncy Castle, already bundled with the server.