Skip to content

Secure File Sharing · Managed File Transfer

The Compliance-First Platform for Moving Sensitive Files to People and Systems

Replace email attachments, consumer file-sharing apps, and old FTP servers with one system that moves files by browser, SFTP, FTPS, SCP, or API and records who opened every one, inside your company and out.

Start free trial Request a demo

  • SOC 2 Type II Attested
  • HIPAA audited annually by A-LIGN
  • FedRAMP Moderate Certified (Sharetru Federal)
  • ITAR: U.S.-citizen staff, U.S.-only data

Built for Defense & Aerospace, Manufacturing, Healthcare, and Financial Services

Show examples for , , , or

G2 Summer 2026: High PerformerG2 Summer 2026: Easiest SetupG2 Summer 2026: Highest User AdoptionG2 Summer 2026: Users Most Likely to Recommend

Scroll to See All Eight Ways In and Out

Eight Ways In and Out

Eight Ways to Move a File. Six of Them Connect Systems Directly.

Two of the eight ways are for a person at a browser. The other six are for systems: your scripts and schedulers, and your partners’ servers, connect over SFTP, FTPS, SCP, or the API with nobody at a keyboard. A file can come in one way and go out another: in by SFTP, out by API; uploaded by hand, pulled by a script into your billing system.

Manual

  1. Web Application

    Upload, download, and manage users and folders in the browser. No client to install, no training to schedule.

    HTTPS · Port 443

  2. Share Links

    Sent by Sharetru, tied to one recipient, with MFA when you require it, and gone on your terms.

    HTTPS · Port 443

Programmable · For Your Scripts and Systems

  1. HTTPS API

    Push, pull, and manage files, users, and groups from your own systems.

    HTTPS · Port 443

  2. SFTP

    File transfer over SSH, built for scripted, scheduled transfers.

    SSH · Port 22

  3. FTPS

    FTP over implicit TLS, encrypted from the first byte.

    Implicit TLS · Port 990

  4. FTPeS

    FTP over explicit TLS, for clients that connect first and then upgrade.

    Explicit TLS · Port 21

  5. SCP

    Secure copy over SSH. Script it once.

    SSH · Port 22

  6. FTP

    Unencrypted, so it’s offered on Sharetru Commercial only when a partner can’t do better, and never on Sharetru Federal.

    Unencrypted · Port 21

    Sharetru Commercial Only

Skip to the next section

Switching from another platform? Sharetru can be up and running in as little as a few hours, and you move partners over at your own pace.

Start free trial

How Files Actually Move

A Governed Way Across Your Boundary

  1. Partners OutsidePartners Outside. Primes, subs, clearinghouses, payers, auditors. They need your files, and none of them needs an account in your environment.
  2. Your BoundaryYour Boundary. Everything inside this line is yours to protect: CUI, ITAR data, ePHI, financial records.
  3. Sharetru at the EdgeSharetru at the Edge. Exchanges you route through Sharetru cross here, at one governed point; email and other open channels stay outside it. Sharetru Federal runs in its own FedRAMP Moderate authorization boundary.
  4. Every CrossingEvery Crossing. Files move in both directions, and a file can arrive one way and leave another: a partner’s SFTP drop, picked up by your API. Every crossing is logged to a user or system account: who, what, when, and from where.
  5. System of RecordSystem of Record. Your environment stays the system of record, and the log flows to the SIEM you already run.

Skip to the next section

Diagram: partners outside your compliance boundary send and receive files through Sharetru, which sits in the boundary’s wall and logs every crossing before files reach your environment. The audit log flows to your SIEM.

Assessed by a 3PAO, Listed by FedRAMP

FedRAMP Moderate Certified at Every Layer

Sharetru Federal is the certified SaaS inside MIS Sciences Corporation’s GovPoint Cloud Services: infrastructure, platform, and software, each audited every year against NIST SP 800-53 Rev 5. The listing is public.

FedRAMP Marketplace Package F1311222650

  1. Cloud service providerMIS Sciences Corporation
  2. Cloud service offeringGovPoint Cloud Services
  3. Service modelIaaS/PaaS/SaaS
  4. Impact levelModerate
  5. BaselineRev5
  6. StatusFedRAMP Certified
  7. Certified servicesSharetru Federal
What the FedRAMP Marketplace shows for package F1311222650: MIS Sciences Corporation’s GovPoint Cloud Services, service model IaaS, PaaS and SaaS, impact level Moderate, Rev5 baseline, status FedRAMP Certified, with Sharetru Federal listed under Certified Services.

One Certification, Three Layers

  1. IaaSMIS Sciences CorporationGovPoint Cloud Services infrastructure
  2. PaaSMIS Sciences CorporationGovPoint Cloud Services platform
  3. SaaSSharetru FederalThe certified SaaS, audited every year at the SaaS layer
All three layers audited against NIST SP 800-53 Rev 5.

Open the FedRAMP listing (opens in a new tab) Get the SOC 2 report and SRM in a free trial

Sharetru Federal is the certified SaaS inside MIS Sciences Corporation’s GovPoint Cloud Services, which provides the IaaS and PaaS layers. Search the Marketplace for GovPoint, or open package F1311222650 directly. During a free trial you can request the SOC 2 Type II report and the shared responsibility matrix (SRM); both are covered by the mutual NDA in Sharetru’s Terms of Service.

Roles and Restrictions

Least Privilege That Survives an Access Review

  • Roles

    • Site administrator. The whole Sharetru site.
    • File or user administrator. Content or people, never both.
    • MSP administrator. Runs the system without seeing CUI or even folder names.
    • Auditor. Reads the record and changes nothing.

  • Restrictions

    • IP range and protocol locks per user.
    • Geo-blocking, and dual authorization for adding new users.
    • SSO for your staff through Entra ID and other major identity providers, plus a generic option for the rest, while partners keep Sharetru credentials.
    • MFA by authenticator app, email, or text on Sharetru Commercial; authenticator-app MFA is always required on Sharetru Federal.
    • Link sharing is its own permission, separate from folder access.

The Record

Every View, Upload, and Download on the Record

  1. CoreSharetru Commercial3 months
  2. CompleteSharetru Commercial6 months
  3. Sharetru FederalFederal Package12 months
  4. ITAR12 months kept by Sharetru+ 4 years kept by you+ 4 years, yours5 years
  5. HIPAAHIPAA Support Package6 years

Kept by SharetruKept by you, through a scheduled API export or your SIEM

Skip to the next section

Every action is logged to the user or system account that took it. Your plan sets how long Sharetru keeps it; the API returns up to 90 days, so keep your own copy through a scheduled pull or SIEM feed.

Compare plans and retention

SIEMs You Can Send Sharetru Logs To

  • Splunk
  • Microsoft Sentinel
  • IBM QRadar
  • CrowdStrike
  • Rapid7
  • Sumo Logic
  • OpenText ArcSight
  • ManageEngine Log360
  • Securonix
  • LogRhythm
  • Arctic Wolf
  • Wazuh

Built as Infrastructure

One API to Push Files In and Pull Them Out

Wire Sharetru into the systems that already make and use your files: the ERP, the claims engine, the EHR, the data warehouse. Your systems send batches on their own schedule, collect inbound files and track what has been processed, add and remove partner access from your own tools, and pull audit evidence on a schedule too.

Send Tonight’s Batch to a Partner

From your ERP, claims engine, or data warehouse, with no one at a keyboard.

  1. POST/api/uploads/Open an upload session with the path, the exact size, and create-new, so yesterday’s file is never overwritten. Retry with the same Idempotency-Key and you get the same session back.
  2. PATCH/api/uploads/{id}/Send the bytes in chunks of up to 10 MiB. If the connection drops, pick up from the last byte received.
  3. POST/api/uploads/{id}/complete/Finalize. Sharetru checks the length, moves the file into place, and returns its record.
  4. POST/api/shares/Share it outbound to the partner’s contacts: one link per email address, up to 100, with an expiration and a use limit.

The batch is waiting in the partner’s folder before anyone at either company logs in.

Open the Upload Session
POST /api/uploads/
X-API-KEY: <your-api-token>
Accept: application/vnd.api+json
Content-Type: application/vnd.api+json
Idempotency-Key: <new-uuid>

{ "data": {
  "type": "upload_session",
  "attributes": {
    "path": "/acme/outbound/claims-0925.zip",
    "size": 48213904,
    "overwrite": false,
    "create_new": true } } }

201 Created

Collect Inbound Files and Track What’s Processed

Claims, remittances, eligibility files, supplier drops. Whatever partners send over SFTP or an inbound share link, your code collects.

  1. GET/api/files/?filter[]=path,begins,…List what has landed in the partner’s inbound folder, sorted and paged.
  2. GET/api/files/{id}/stat/Check the size and checksum without downloading a byte.
  3. GET/api/files/{id}/Download it. A byte-range request resumes a large file mid-stream.
  4. PATCH/api/files/{id}/Move it to a processed folder, so later runs can tell it has been handled.

Partners can keep dropping files over SFTP. Your code picks them up over HTTPS.

List the Inbound Folder
GET /api/files/?filter[]=path,begins,/acme/inbound/
X-API-KEY: <your-api-token>
Accept: application/vnd.api+json

200 OK
{ "data": [ {
    "type": "file",
    "id": "01980c6b-2d25-79b0-b754-7c1e7f06d4e8",
    "attributes": {
      "name": "remit-0925.835",
      "bytes": 184320,
      "ts_updated": 1790290800 } } ] }

Onboard and Offboard Partners From Your Own Systems

When a contract is signed in your vendor system or CRM, access follows. When it ends, access ends.

  1. POST/api/users/Create the partner’s account with a suspension date that matches the contract’s end.
  2. POST/api/group_members/Put them in the partner group.
  3. POST/api/permissions/group/Grant one folder, down to upload, download, and view. Nothing above it opens.
  4. POST/api/network_rules/Lock the account to their public IP range and one protocol, such as SFTP only.
  5. DELETE/api/users/{id}/Close it out. Their permissions, SSH keys, and network rules go with the account.

Access ends on the contract date, even if nobody remembers to end it.

Create the Partner’s Account
POST /api/users/
X-API-KEY: <your-api-token>
Accept: application/vnd.api+json
Content-Type: application/vnd.api+json

{ "data": {
  "type": "user",
  "attributes": {
    "username": "acme-sftp",
    "email": "files@acme.example",
    "name": "Acme Supply",
    "date_to_suspend": "2027-09-30" } } }

201 Created

Pull Audit Evidence on a Schedule

For the assessor, the quarterly access review, and any retention requirement longer than Sharetru keeps.

  1. GET/api/file_log/Every upload, download, move, and deletion: who, when, from which IP address, over which protocol and port.
  2. GET/api/admin_log/Every administrative action on the site.
  3. GET/api/permissions/Every folder permission held by users and groups, ready for the access review.

Sharetru keeps the log for your plan’s retention period, and the API returns up to 90 days of it. A nightly pull into your archive or SIEM keeps your own copy whole, including ITAR’s years two through five.

One Month of File Activity
GET /api/file_log/?filter[]=date_time,begins,2026-09
X-API-KEY: <your-api-token>
Accept: application/vnd.api+json

200 OK
{ "data": [ {
    "type": "file_log",
    "attributes": {
      "date_time": {
        "date": "2026-09-24 21:14:07.000000",
        "timezone": "America/New_York" },
      "user": "acme-sftp",
      "ip_address": "203.0.113.24",
      "protocol": "sftp",
      "port": "22" } } ] }

Built for Production

  • Resumable Chunked Uploads
  • Idempotent Retries
  • Byte-Range Downloads
  • File Checksums
  • Filter, Sort, Fields, Pages
  • Retry-After on Rate Limits
  • OpenAPI 3.0
  • JSON:API

60 endpoints across files, uploads, shares, folders, users, groups, permissions, network rules, and the file and admin logs. Real endpoints from the Sharetru API reference; paths, IDs, and keys in the samples are examples. The API keeps expanding.

Read the API docs See which plans include the API

Built for Regulated Industries

Where a File Leaving the Building Is Somebody’s Problem

  • FedRAMP · ITAR · DFARS

    Defense & Aerospace

    CUI, ITAR-controlled drawings, and CAD assemblies too big for email, on FedRAMP Moderate Certified Sharetru Federal, handled by U.S.-citizen staff and stored only in the United States, with support for DFARS 252.204-7012 and CMMC Level 2 workflows.

    Explore Defense & Aerospace

  • Suppliers · Customers · ERP

    Manufacturing

    Drawings, RFQs, and quality records moving between your plants, suppliers, and customers, sent by a person or on a schedule from your ERP, with every file on the record and no in-house FTP server left to patch.

    See Supplier File Transfer

  • HIPAA · Claims · EDI

    Healthcare

    Claims, remittances, eligibility files, and PHI moving between providers, payers, clearinghouses, and billing partners, on schedule or by link, on a HIPAA-audited platform with six years of audit log and Sharetru’s signed BAA on the HIPAA Support Package.

    Explore Healthcare

  • GLBA · SOX · PCI DSS

    Financial Services

    Banks, credit unions, and investment managers exchanging files with customers, auditors, and counterparties.

    Explore Financial Services

Start Where You Are

Your Next Audit Will Ask How Files Leave. Have the Answer Ready, in Their Words.

Request a demo and bring one partner workflow or your assessor’s questionnaire. We’ll send you a Sharetru link to upload it, so it never sits in anyone’s inbox, then walk through it with you. Or start a 15-day free trial.

Security Questionnaire · Sample Response to Edit

How are files transferred outside the organization, and how is access to them controlled and logged?

  1. ControlExternal transfers for [the workflows you route through Sharetru, e.g., supplier drawings, partner SFTP drops] are made through Sharetru [Commercial or Federal] (SOC 2 Type II Attested; HIPAA audited annually by A-LIGN; Sharetru Federal is FedRAMP Moderate Certified).
  2. Named recipientsFiles are shared as links bound to a single named recipient, who must sign in [with MFA, or: with authenticator-app MFA on Sharetru Federal] to open them. Links expire, are use-limited, and can be view-only. Forwarded links do not open.
  3. System transfers[SFTP, FTPS, or the HTTPS API], under per-account credentials [with IP-range and protocol restrictions enabled].
  4. LoggingEvery upload, download, view, move, and deletion is logged with the user or system account, timestamp, source IP address, and protocol. Administrative actions are logged separately.
  5. RetentionLogs are retained for [your plan’s retention period], exportable by API, and [streamed to your SIEM, or exported on a schedule].
  6. EvidenceSOC 2 Type II report, HIPAA audit report, shared responsibility matrix, and the FedRAMP 3PAO assessment letter for Sharetru Federal, on request; FedRAMP Marketplace package F1311222650.

Request a demo See plans and start a trial Talk through how you move files today