Bring your own bucketSFTP to Wasabi, for archives and backups
Wasabi charges a flat price per terabyte with no fees for egress or API requests, within its fair-use policies. CloudFile puts an SFTP, FTPS and FTP server in front of a Wasabi bucket, which suits archives and backups that stay put.
Wasabi with CloudFile, at a glance.
| Endpoint | https://s3.<region>.wasabisys.com, filled in from the region |
|---|---|
| URL style | Virtual-hosted |
| Credentials | Access key of a Wasabi sub-user with programmatic access and a policy for one bucket |
| Regions | Europe (including Amsterdam and Frankfurt), North America and Asia-Pacific. The region is part of the endpoint and fixed per bucket. |
| Pricing model | $7.99 per TB per month on pay as you go, with a 1 TB minimum. No charge for egress or API requests while downloads stay within your stored volume. |
| Minimum duration | 90 days on pay as you go: deleting a file sooner is billed for the remaining days |
Wasabi prices are from their public website as of October 2026, excluding taxes. Your bucket is billed by Wasabi, not by us, and doesn't count toward your plan's storage.
Why pair SFTP with Wasabi.
No egress or request line items
Many small SFTP operations and partner downloads don't add request or transfer charges, as long as monthly downloads stay within what you store.
Predictable for archives
Storage is priced per terabyte, so a growing archive of scans, exports or backups grows the bill in a straight line.
Object lock for backups
Wasabi supports object lock. With an SFTP user that can't delete or overwrite, old backups survive a compromised client.
A user per bucket
Create a sub-user with a bucket-scoped policy and programmatic access only, so CloudFile's key can't list or reach your other buckets.
How it works, in three steps.
- Step 1
Create a bucket and a sub-user
Pick the region. Create a policy for this bucket and a sub-user with programmatic access, and attach the policy.
cloudfile → policy cloudfile-acme-archive - Step 2
Connect it in CloudFile
Storage → Add bucket → Wasabi. Pick the region and paste the sub-user's keys.
https://s3.eu-central-2.wasabisys.com ✓ test passed - Step 3
Uploads go to Wasabi
Each SFTP or FTP user writes to its own prefix, and a webhook or email confirms every upload.
scanner-2f → acme-archive/scans/scanner-2f/0193.pdf
Every click and field is in the Wasabi setup guide.
What your partners see, and where it lands in Wasabi.
$ sftp -P 22000 [email protected]
sftp> put invoice-2026-10.pdf
sftp> ls
invoice-2026-10.pdfYour Wasabi bucket<bucket>/<folder>/acme/invoice-2026-10.pdf
<bucket>/<folder>/_shared/inbox/…Any SFTP, FTPS or FTP client: FileZilla, WinSCP, Cyberduck, the sftp command or their own system. WebDAV too, if you turn it on.
Their own home folder as /, and nothing else. They never see the bucket name, other users' folders or your keys.
A password, an SSH key or both, with the permissions you pick: full access, read only or upload only.
Shared folders at /shared/<name> when several users need the same files. They live under _shared/<name>/ in your Wasabi bucket.
Get these right in Wasabi.
Files deleted within 90 days are still billed for 90 days on pay as you go. A short-lived drop folder that's emptied daily costs more than it looks.
Wasabi's free egress assumes your monthly downloads stay within your stored volume. Servers where partners download much more than you store are a better fit for R2.
Leave versioning and object locking off unless the bucket is for backups: they keep deleted files (billed) or stop deletes.
Questions about SFTP on Wasabi.
Is Wasabi a good fit for a partner drop folder?
Only if files are kept for a while. On pay as you go, each file is billed for at least 90 days, so folders that are emptied every day are cheaper on R2, B2 or Hetzner.
Which Wasabi region should I pick?
One close to where the files are used. eu-central-1 is Amsterdam and eu-central-2 is Frankfurt. The region becomes part of the endpoint and can't be changed for the bucket.
Does the sub-user need ListAllMyBuckets?
No. Wasabi's examples include it for console sign-in. CloudFile only needs ListBucket on the bucket and Get, Put, Delete and AbortMultipartUpload on its objects.
Can I use object lock for ransomware-proof backups?
Yes. Use a dedicated versioned bucket with object lock, and give the backup login no Delete or Overwrite permission. See our ransomware-proof backups page for the full setup.
More in the docs: Wasabi setup · Your own bucket · Webhooks
