How we keep your files safe and in the EU

• Hetzner, Germany

  The dashboard, database, SFTP servers and file storage run on Hetzner infrastructure in Germany. Your files stay in the EU unless you choose otherwise.

• Or your own bucket

  Connect any S3-compatible bucket and pick its provider and region yourself. Files then live in your account, and you can revoke our access at any time.

  Your own bucket

• Private control network

  The agent that starts servers and each server's admin API are reachable only from our private network with a secret token. They are never exposed to the internet.

• One container per server

  Every server is its own SFTPGo container with its own configuration, users, ports and admin credentials.

• Users locked into their folder

  Each server stores files under its own storage prefix, and each SFTP user under their own folder within it. Users can't see each other's files unless you give them a shared folder or access to the whole server.

• Fine-grained permissions

  Choose per user whether they can list, download, upload, overwrite, delete, rename or create folders, and set quotas and bandwidth limits.

  Users and permissions

• Encrypted protocols

  SFTP runs over SSH. FTPS and WebDAV use TLS with Let's Encrypt certificates, and WebDAV never runs over plain HTTP. The website, dashboard and API are HTTPS only.

• Plain FTP is opt-in

  Unencrypted FTP is off for new servers and marked insecure in the dashboard. When a user only has FTPS, the server refuses their login without TLS.

• Secrets encrypted at rest

  Storage credentials, server admin secrets and webhook signing secrets are encrypted in our database with AES-256-GCM. API keys are stored only as SHA-256 hashes.

• Two-factor sign-in

  Protect dashboard accounts with TOTP two-factor authentication and backup codes. Passwords must be at least 10 characters.

  Team and roles

• Roles and API keys

  Owners and admins manage servers, storage and billing; members handle day-to-day work. API keys belong to the organization and carry the admin or member role.

  API

• Audit log

  Every change made in the dashboard or with an API key is recorded with who made it and when. Entries are kept for 365 days.

• Access by IP

  Allow logins only from listed IP addresses or ranges, and block others, for every user of a server. Available on Pro and Business.

  Access by IP

• Brute-force protection

  Each server runs SFTPGo's defender, which automatically blocks clients after repeated failed logins.

• We don't keep SFTP passwords

  Generated passwords are shown once and handed to the server, which stores only a salted hash. Our database doesn't store them. SSH keys are public keys only.

• Signed webhooks

  Every delivery carries an HMAC-SHA256 signature over a timestamp and the body, so you can reject forged or replayed requests.

  Verify signatures

• Outbound request guard

  Webhook targets and storage endpoints must use HTTPS and resolve to a public address. Webhook targets are checked again on every delivery, so they can't be pointed at our internal systems.

• Expiring download links

  Download links in webhooks are created fresh for each delivery and expire after one hour. Links from the web file manager expire after five minutes.

• Daily database backups

  The database is dumped to object storage every day, and old dumps are deleted automatically after 14 days.

• Monitoring and status

  Automated checks watch the dashboard, servers, storage and webhooks, and alert us when something breaks. Results are public on the status page.

  Status page

• Upstream SFTPGo

  Servers run the unmodified, open-source SFTPGo image (AGPL-3.0), so the code that handles your connections is public and widely reviewed.

• No card data on our side

  Paddle is the merchant of record and processes every payment. Card details go straight to Paddle and never reach our servers.

• We don't hold SOC 2, ISO 27001 or other third-party certifications.

• Plain FTP is unencrypted. Keep it off unless a legacy client needs it.

• Files in our managed storage rely on Hetzner's storage security. For encryption at rest under keys you control, use your own bucket with server-side encryption.

More: Security docs · Your own bucket · Webhooks · Team and roles · Privacy policy