Replacing a Legacy SFTP Server in 2026: How the Main Options Compare

The best replacement for a legacy SFTP server is the one that keeps your partners' connections working while taking patching, logging and compliance evidence off your team: for most organizations that is a hosted managed file transfer (MFT) service, and for CUI, ITAR or federal work it is one whose FedRAMP status you can verify on fedramp.gov. Self-hosted MFT software and cloud-provider SFTP endpoints are also real options, but they leave the server, or the evidence, with you.

This guide compares the five ways organizations replace an aging SFTP or FTP server in 2026, what each one leaves on your plate, and the questions that decide between them. If you have already decided to move and want the cost model and cutover plan, read Replacing an in-house SFTP or FTP server: cost and cutover.

What are the options for replacing a legacy SFTP server?

There are five paths. They differ less in protocols, since all of them speak SFTP, than in who runs the server, who patches it and who answers an auditor.

1. A hosted MFT or secure file transfer service (SaaS). The vendor runs the servers; you get SFTP and FTPS endpoints for systems, a web app and links for people, an API, and a record of every transfer. Examples include Sharetru, Files.com and Fortra's hosted GoAnywhere (MFTaaS).
2. MFT software you install and run. Products such as GoAnywhere MFT and MOVEit Transfer run on your own servers or cloud instances. You get workflow features such as schedulers and AS2, and you keep patching, hardening and uptime.
3. A cloud provider's SFTP endpoint. AWS Transfer Family and Azure Blob Storage SFTP put an SFTP front door on object storage. They suit system-to-system feeds into a cloud you already run; user management, partner onboarding and reporting are yours to build.
4. A secure content platform with SFTP included. Platforms such as Kiteworks bundle SFTP with secure email, file sharing and forms, often as a single-tenant appliance or private cloud.
5. Keep the server and harden it. Patch, restrict, add logging and MFA. It is the cheapest month and the most expensive year: every vulnerability, audit question and on-call page stays with you.

How do the options compare?

Which services carry FedRAMP status, as of November 2026?

For CUI, ITAR technical data or a federal contract, the deciding question is whether the specific service you will use is listed on the FedRAMP Marketplace, at what level and in whose package. Vendor pages change often and sometimes disagree with each other, so treat the list below as a starting point and confirm each entry on marketplace.fedramp.gov before you buy.

• Sharetru Federal: FedRAMP Rev 5 (Class C) Certified, the new name for FedRAMP Moderate, as the SaaS layer of MIS Sciences Corporation's GovPoint Cloud Services package, F1311222650. How to verify it.
• Kiteworks: describes itself as FedRAMP Moderate authorized and, as of its March 2026 announcement, FedRAMP High "In Process" for its Secure Gov Cloud.
• AWS Transfer Family: AWS announced in December 2021 FedRAMP Moderate in four commercial US regions and FedRAMP High in the GovCloud (US) regions. The authorization covers the endpoint, not the identity, storage and reporting you build around it.
• Files.com: reported on August 31, 2026 that it earned FedRAMP Class A certification through the FedRAMP 20x program path. Class A is a different level from Class C (Moderate); check which level your contract requires.
• Self-hosted MFT software (for example GoAnywhere MFT or MOVEit Transfer) has no FedRAMP authorization of its own, because FedRAMP authorizes cloud services, not software you run. Your environment carries the controls.

What should decide between them?

Six questions settle most decisions. Answer them before you look at feature lists.

1. Who will patch it? The MOVEit, GoAnywhere and Accellion attacks all hit file transfer servers that customers or vendors had to patch in a hurry. If your team cannot patch within days, choose a path where someone else does.
2. What data moves, and under which rules? CUI, ITAR technical data, ePHI and payment data each bring their own requirements. Match the service's evidence (SOC 2 Type II, a signed BAA, a FedRAMP listing) to the data, not to the vendor's marketing.
3. What do partners have to change? If your server's hostname is a public name you own, a hosted service can usually take it over, so partners keep the same address. Their SFTP clients will still see a new host key and must accept it once, so tell them before cutover.
4. How are transfers scheduled today? If your scripts and schedulers drive transfers, any path works. If the server itself runs complex schedules or AS2 exchanges, self-hosted MFT software or a service with a built-in scheduler fits better.
5. What record will an auditor ask for? Check how long logs are kept, whether they can be exported or forwarded to your SIEM, and whether every upload, download and permission change is attributed to a person or account.
6. What does it really cost? Compare the subscription with the full cost of the server you have: hardware or cloud instances, licences, patching hours, on-call time and the work of every security review. The cost chapter of our cutover guide walks through it with your own numbers.

Why do government teams struggle to modernize legacy file transfer?

Most stalls come from the same three places: nobody owns an inventory of who connects and how, the replacement's compliance boundary is unclear, and the cutover is planned as one big switch. Agencies and their contractors often inherit servers that grew partner by partner over a decade, with credentials and scripts nobody documented.

Compliance issues follow the same pattern. A service can be FedRAMP authorized while the specific feature or deployment you use sits outside its boundary, or a vendor can call a product "FedRAMP equivalent", which is not a FedRAMP authorization. Logs kept too briefly, shared accounts and partners connecting with no MFA are the findings that most often surface in assessments.

How do teams modernize a legacy SFTP or MFT system without breaking production?

1. Inventory every connection. List each partner, script and system, its protocol, authentication method and schedule. Server logs from the last 90 days are the fastest source.
2. Pick the path from the six questions above, and confirm the compliance evidence before the trial, not after.
3. Run a trial with real transfers. Move one partner and one script, check what was logged for each, and confirm the record answers your auditor's questions.
4. Move partners in waves. Start with the partners who connect by link or web app, then scripted systems, then the partners whose clients need a host key accepted.
5. Keep the old server read-only for a set period, then retire it and its credentials.

Our cutover guide covers each step in detail, including where a partner's first connection usually fails.

Where does Sharetru fit, and where doesn't it?

Sharetru is a hosted service for exchanging sensitive files with partners: links for people, SFTP and FTPS for systems, and a REST API for software, with every action logged. It comes in two plans, Core from $199 a month and Complete from $499 a month, each on Sharetru Commercial or on Sharetru Federal for CUI and ITAR data. Guests are unlimited on every plan, and there is a 15-day free trial.

It is not the right fit for everything. Sharetru has no built-in scheduler, so your own scripts and schedulers drive automated transfers, and it does not support AS2. If your exchanges depend on either, self-hosted MFT software or a service built around them will serve you better. The Sharetru FAQ lists what it does and doesn't do.

Sources

• FedRAMP Marketplace: marketplace.fedramp.gov
• Kiteworks, Kiteworks Advances to FedRAMP High In Process (March 2026)
• AWS, AWS Transfer Family is now FedRAMP compliant (December 2021)
• Files.com, Files.com FedRAMP certified (August 2026)
• Fortra, Evaluating a hosted or SaaS MFT solution