sftpcloud alternative
AWS Transfer Family alternative
Couchdrop alternative
Files.com alternative
DocEvent.io alternative
SFTP To Go alternativeAn SFTP layer for
your cloud storage.
Put a managed SFTP and FTP endpoint in front of S3, R2, Azure or any S3-compatible bucket.Every upload can trigger a signed webhook.Hosted in the EU, from €9 a month.
No credit card required
From sign-up to first webhook. About a minute.
- Step 1cloudfile.dev/app/newNameacme-prodLocation🇩🇪 FalkensteinSFTPFTPSFTPWebDAVacme-prodRunningHost
acme-prod.cloudfile.devSFTP on port 22Create a server
Pick a name and a location. Your SFTP, FTPS, FTP or WebDAV endpoint is live in seconds.
- Step 2cloudfile.dev/app/users
crm-exportSSH key3.4 GB of 5 GBscanner-2fPassword0.6 GB of 2 GBUpload onlycloudfile.dev/u/k3x9…Upload link, no login neededAdd users, or share a link
Give each partner or device a login with a password or SSH key, a home folder and a quota. Or send a link for one-off uploads.
- Step 3cloudfile.dev/app/eventsActiveNew listingshttps://api.acme.com/hooks/filesuploadrenamein /incomingSigning secret
whsec_••••••••••••••••Last delivery 12 s ago200 OK · 84 msGet a webhook
Point a listener at your API. Each upload, rename or delete arrives as signed JSON with a link to the file.
Every upload can call your code. Signed, retried and logged.
Create a listener, choose the events and an optional path filter, and CloudFile POSTs JSON to your URL within moments of the file landing.
- 200 OK · 68 ms/incoming/invoices-10.csvupload · erp
- 200 OK · 79 ms/incoming/listings.xmlupload · crm-export
- 200 OK · 74 ms/incoming/stock.jsonupload · erp · retry 1
- 503 · retry in 30 s/incoming/stock.jsonupload · erp
- 200 OK · 97 ms/incoming/offers.ziprename · crm-export
- 200 OK · 61 ms/incoming/orders-1042.csvupload · erp
- 200 OK · 84 ms/incoming/listings.xmlupload · crm-export
Every attempt is logged with its status and response time. Failed deliveries retry on their own, each with a fresh download link.
POST /hooks/files
X-CloudFile-Signature: t=1792575945,v1=5f2c…{
"event": "upload",
"status": "OK",
"full_path": "/incoming/listings.xml",
"protocol": "SFTP",
"user": { "name": "crm-export" },
"file_size": 48213,
"download_url": "https://…?X-Amz-Signature=…",
"download_expires_at": 1792579545
}import { createHmac, timingSafeEqual } from "node:crypto"
const [t, v1] = header.split(",").map((s) => s.split("=")[1])
const mac = createHmac("sha256", secret)
.update(`${t}.${rawBody}`).digest("hex")
const ok = timingSafeEqual(Buffer.from(mac), Buffer.from(v1))
const fresh = Math.abs(Date.now() / 1000 - t) < 300
if (!ok || !fresh) throw new Error("rejected")For Claude Code, Cursor or Codex. See the prompt
Add a CloudFile webhook endpoint to this project.
CloudFile (https://cloudfile.dev) runs managed SFTP, FTPS and FTP servers and POSTs a JSON event to a URL whenever files change. Read https://cloudfile.dev/docs/webhooks.md before you start, and https://cloudfile.dev/llms.txt for context.
First look at the project to find the language, framework and whether it has a background job queue. Then ask me what should happen with each uploaded file.
Requirements:
1. A POST route, for example /webhooks/cloudfile, that reads the raw request body before any JSON parsing.
2. Verify the X-CloudFile-Signature header, which looks like t=<unix seconds>,v1=<hex>. Compute HMAC-SHA256 of "{t}.{raw body}" with the signing secret and compare it to v1 in constant time. Answer 400 if it doesn't match or if t is more than 300 seconds away from now.
3. Read the secret from the CLOUDFILE_WEBHOOK_SECRET environment variable (it starts with whsec_). Never hard-code it, and add it to .env.example.
4. Answer with a 2xx status within 10 seconds. Download and process the file in a background job if the project has a queue.
5. Handle "upload" and "rename" events with status "OK". For renames, full_path is the new name. Answer 200 to every other event and ignore it.
6. Download the file with a plain GET on download_url. It needs no credentials and works for one hour. Retried deliveries carry a fresh URL.
7. Deliveries are retried on failure, so make processing idempotent, for example keyed on event + full_path + timestamp.
8. Add tests that sign the sample payload from the docs and check that valid, tampered and stale requests are handled correctly.
When you're done, tell me how to connect it: in the CloudFile dashboard open the server, go to Event listeners, click Add listener, choose Webhook, enter the public HTTPS URL and copy the signing secret into CLOUDFILE_WEBHOOK_SECRET. Use Send test to check it.No code needed for alerts.
The same listener can post a message to Slack, Discord or Microsoft Teams, or send an email. Filter by folder or user, so the scanner on the second floor gets its own channel.
Webhooks docsOr let CloudFile handle the file. No code needed.
Workflows move, rename, copy and clean up files for you, with conditions for each branch. Run them on upload, on a schedule or on demand.
- Sort uploads into {yyyy}/{mm} folders
- Copy every file to your own S3 bucket
- Delete files older than 30 days every night
- Ping Slack when an unexpected file arrives
Your bucket, your files. CloudFile just sits in front.
Connect Amazon S3, Cloudflare R2, Backblaze B2, Wasabi, Hetzner, Google Cloud Storage, Azure Blob Storage or any S3-compatible service. Uploads land under your keys and your provider bills the storage. S3-compatible storage and Azure Blob are available on every plan.
- Encryption at rest and retention stay under your own policies
- Storage in your bucket doesn't count towards your plan
- Cancel CloudFile and there is nothing to export
SFTP to your provider
Built for partners, devices and the systems that only speak SFTP.
Partner and CRM feeds
A real-estate CRM exports its property listings to your SFTP address every night. Your code picks each file up the moment it lands.
Learn moreScanners, cameras and devices
Scan-to-FTP and camera uploads go to the cloud instead of a PC under the desk, with a Slack message per file if you want one.
Learn moreReplace your own SFTP server
Keep the same usernames and keys, drop the VM, the patching and the 3 a.m. disk alerts. Files go to a bucket you control.
Learn more
Control who connects without the guesswork.
acme-prod.cloudfile.dev22Audit log
Every change to servers, users and settings, with who made it and when.
Two-factor sign-in
Protect dashboard accounts with an authenticator app.
IP allow and deny
Limit a server to the addresses you trust or block the ones you don't. On Pro and Business.
Shared folders with roles
Can edit, Can view or Upload only, set per member of a folder.
Live connections
See who is connected right now and over which protocol, and disconnect a session.
Logs explorer
Search every login, transfer and failure by user, path or protocol.
Servers run on Hetzner in Germany and files are stored in the EU. We sign a DPA, publish a security overview and keep a live status page. We are not SOC 2 or ISO 27001 certified.
Simple, flat pricing. Pay yearly and get two months free.
€9/ month
- 1 server
- 3 SFTP users
- 5 GB storage included
- SFTP, FTPS, FTP and WebDAV
- Webhooks, email and chat alerts
€19/ month
- 1 server
- 10 SFTP users
- 10 GB storage included
- Everything in Solo
- 3 workflows per server
€59/ month
- 5 servers
- Unlimited SFTP users
- 250 GB storage included
- Everything in Starter
- Ports 22 and 21, static IP
€179/ month
- 20 servers
- Unlimited SFTP users
- 1 TB storage included
- Everything in Pro
- SSOSoon
Need more? +€10 per extra server, +€20 per extra TB a month. Prices exclude VAT.
What people ask before they sign up.
What is SFTP as a service?
It's SFTP hosting without a server of your own. You don't size, patch or monitor a VM, open ports or renew certificates. CloudFile runs an isolated SFTP, FTPS and FTP server for you, you hand out logins, and files land in our EU storage or in your own bucket. Plans are a flat monthly price from €9, not billed per hour or per gigabyte.
How does CloudFile work with my own bucket?
You enter the bucket's endpoint and an access key with read and write rights on it. CloudFile then serves SFTP, FTPS, FTP and WebDAV in front of it and writes every upload straight into your bucket. It works on Amazon S3, Cloudflare R2, Backblaze B2, Wasabi, Hetzner, Google Cloud Storage, Azure Blob Storage, Scaleway, OVHcloud, MinIO and any other S3-compatible service.
How do webhooks work?
Create an event listener, choose the events and optional path or username filters, and give us a URL. Each request is signed with HMAC-SHA256 in an X-CloudFile-Signature header so you can verify it came from us, and it carries a link to download the file. Failed deliveries are retried. You can also post to Slack, Discord or Microsoft Teams, or send an email.
Can CloudFile move or sort files automatically?
Yes. Workflows run inside your server: on an upload, on a schedule or on demand, they check conditions such as the file name, folder or size, then move, rename, copy, delete or send the file to your own bucket, a webhook or a Slack, Discord or Teams channel. You build them in a visual editor, and every run is logged with what each step did.
Which clients can connect?
Anything that speaks SFTP, FTPS or FTP: FileZilla, WinSCP, Cyberduck, the sftp command, rclone, and most ERP and EDI systems. WebDAV lets Windows and macOS map a server as a network drive.
Where are my files stored?
By default in CloudFile's S3-compatible object storage in the EU, where each user's files sit under their own prefix and never mix with other customers. Or in your own bucket, wherever it is, so files stay in your cloud.
What happens to my files if I leave?
If you use your own bucket, nothing happens to them. They stay where they are, under your keys, and your provider keeps billing you directly. If you use our storage, you can download everything at any time with an SFTP client or the web file manager. A deleted server's files are removed from our storage after 7 days.
Do you have SOC 2?
Not yet. CloudFile is not SOC 2 or ISO 27001 certified. What we do have: servers in Germany and storage in the EU, a data processing agreement under Art. 28 GDPR that applies to every paid plan, an isolated container per server, encrypted transfers, two-factor sign-in, an audit log and a public status page. The security page has the details.
Can I move from my own SFTP server?
Yes. Create a server, add the same usernames and public keys, then copy the files across with rclone or sftp. A custom domain on Pro and Business lets partners keep connecting to the hostname they already use. They may have to accept a new host key once.
Is there a free trial?
Yes. Every account starts with a 7-day trial of the Pro plan. No credit card is needed until you pick a plan.
What happens when my trial ends?
Your servers are paused and users can't log in, but your files are kept. Choose a plan and everything resumes right away.
Can I cancel any time?
Yes. Manage or cancel your subscription from the billing page. Yearly plans include two months for free.
Only testing a client or a firewall? Try the free SFTP tools.