Managed file transfer (MFT): move files between people and systems, and prove every one

Why does managed file transfer still matter in 2026? Because much of the work between companies still moves as files, and auditors ask you to prove what happened to each one. Drawings go to suppliers, claim batches to clearinghouses, payment files to banks and nightly exports to partners’ systems. A regulator doesn’t ask whether you sent the file. It asks who could reach it, how it was protected and what happened to it next.

MFT at a glance

• Moves files between people, systems and organizations.
• Over SFTP, FTPS, HTTPS and APIs, plus AS2 on some platforms.
• Controls who, what, which protocol, from where and for how long.
• Records every sign-in, upload, download, deletion and permission change.
• Runs on your servers, in your cloud account, or as a hosted service.
• Replaces email attachments, consumer links and unmanaged FTP servers.

Chapters 1 to 5 are vendor-neutral: what MFT is, the protocols and channels it needs, where it should run, what compliance asks of it, and how to choose a vendor. Chapter 6 is about Sharetru, and it says where Sharetru isn’t the right fit as plainly as where it is.

Managed file transfer (MFT) is software that moves files between people, systems and organizations under central control: encrypted, access-controlled and logged. It replaces the mix of email attachments, consumer sharing links and unmanaged FTP servers with one service where every transfer has an owner, a policy and a record.

What makes a transfer “managed”?

Three things: control over who may move what, protection for the file on the way and at rest, and proof of what happened.

• Control. An administrator decides who may send what to whom, over which protocol, from which network address, and how long a file stays.
• Protection. Files are encrypted in transit and at rest, with cryptographic modules an independent lab has validated, not merely ones described as “compliant”.
• Proof. Every sign-in, upload, download, deletion and permission change is recorded, kept as long as your framework requires, and exportable when an auditor asks.

“Managed” describes the transfer, not who runs the software. You can run MFT on your own servers, run it yourself in a cloud account, or subscribe to a provider who runs it for you, sometimes called MFT as a service (MFTaaS). Chapter 3 covers what each model leaves on your plate.

How does MFT work?

An MFT platform puts five layers between a file and its destination: an endpoint, identity, policy, automation and a record. Each answers one question an auditor will ask, and a gap in any of them is where file transfer usually fails.

How is MFT different from SFTP, FTPS, file sharing and email?

SFTP and FTPS are protocols; MFT governs them. File sharing serves teamwork inside a company; MFT serves exchange across its edge. Most organizations need more than one of these, so the useful question is which job each one does.

Two misreadings are common. “We use SFTP, so we have MFT”: SFTP encrypts the connection, but it doesn’t decide who may connect, keep a record anyone can read, or delete yesterday’s files. “We have SharePoint or Box, so we don’t need MFT”: those are excellent systems of record for people. Unattended transfers with partners who will never take a seat in your tenant are a different job, which is why many companies run MFT beside file sharing rather than instead of it.

At minimum, SFTP and HTTPS. Add FTPS for partners on older systems, and AS2 only if your trading partners require it.

How strong is the encryption behind those names?

The protocol name doesn’t tell you the cipher, so ask three questions: which TLS versions, which SSH key types, and which validated modules. TLS 1.2 is the floor and 1.3 is preferable where a framework asks for it. User keys should include RSA, ECDSA and Ed25519. The cryptographic modules should hold a current FIPS 140 validation certificate; chapter 4 explains why that last question matters.

Where does OpenPGP fit?

OpenPGP isn’t a file transfer protocol: it’s an open standard for public-key encryption, digital signing and authentication of the file itself. A protocol protects a file while it travels; an OpenPGP-encrypted file stays encrypted on disk at both ends, whichever protocol carries it, and its signature proves who sent it and that it wasn’t changed. Banks, payroll and benefits providers often require it. A platform can apply it for you, or you can encrypt files before they’re sent.

The test for any platform: can you answer “who moved this file?” with a single name, whether that name is a person, a system or an agent?

Does SaaS take compliance off your plate?

No: SaaS moves the running of the platform to the provider, but you still decide who gets access, which protocols are on and how long files stay. Your auditor will still ask you to show those settings.

When is each model the right one?

On-premises fits air-gapped networks and teams that patch internet-facing software within hours; SaaS fits most mid-sized companies. Choose your own servers for workloads that may not leave a tightly controlled environment, or when a security team owns patching around the clock. Choose SaaS where one or two people run IT and the file transfer server is one of forty things they own. The record below is why that distinction matters.

What should buyers take from the record?

That the risk follows the architecture, not one vendor: concentrated data, internet exposure and patching that falls to whoever runs the server.

1. Concentration makes the target. A file transfer server holds files from every partner it serves, so one flaw can expose all of them at once. That is why one group came back to file transfer products four times in four years. In the 2023 GoAnywhere campaign alone, the group claimed to have taken data from about 130 victims.
2. Patching fast isn’t enough. Several of these flaws were exploited before a fix existed. What limits the damage is how little data sits on the server, how isolated it is from the rest of your network, and whether your logs show what was taken.
3. “Self-hosted” means the emergency is yours. When an advisory lands at 9 p.m. on a Friday, someone on your team must apply the fix, check for compromise and report. Ask whether that person exists, and whether they’d see the advisory in time.
4. SaaS moves the work; it doesn’t remove the question. A hosted service faces the internet too. The provider’s engineers patch it, so ask them the same things: who patches, how fast, how you’ll be told, and what their own vulnerability history looks like.
5. Ask for the record, not the reassurance. Few vendors can hand you a CVE history, a notice commitment in the contract and an audit report for the period you care about. Chapter 5’s checklist asks for all three.

Most frameworks ask four things of file transfer: control access, encrypt in transit and at rest, record what happened, and prove it. The details differ by framework, and so does the part that stays yours.

Which framework asks for what?

Two habits save time at assessment. Keep the provider’s reports with your own evidence, because assessors ask for the controls you inherit. And set log retention to the longest framework you’re under: HIPAA documentation is kept for six years, and some contracts ask for more.

This table is a starting map, not legal advice. Your assessor and counsel decide what applies to you.

What do FedRAMP and FIPS 140-3 mean for an MFT buyer?

FedRAMP authorizes cloud services for U.S. government data; FIPS 140 validates cryptographic modules. Check both on official lists, because a listing or certificate number is evidence and a vendor’s word isn’t.

FedRAMP. Cloud services are assessed against NIST SP 800-53 controls at Low, Moderate or High impact. Moderate is the level DFARS 7012 points to for services that store CUI. Since February 2026 FedRAMP has called its approved services “Certified” rather than “Authorized”. Every listed service appears on the FedRAMP Marketplace (opens in a new tab) with a package ID. Search it yourself, and note which product and which layer the listing covers: some services are listed as software running on another company’s infrastructure listing, which is normal, but you should know whose package covers what.

FIPS 140. “Validated” means an accredited lab tested the module and NIST’s Cryptographic Module Validation Program (opens in a new tab) issued a certificate with a number you can look up. “FIPS compliant” has no formal meaning. NIST moved FIPS 140-2 certificates to its historical list in September 2026, and new validations are FIPS 140-3. Modules on the historical list can still be used in existing systems, but for new CUI work, ask whether the vendor runs FIPS 140-3 modules and for the certificate numbers.

Three questions settle most claims:

1. What is your FedRAMP Marketplace package ID, and which product does it cover?
2. What are your CMVP certificate numbers, and are they FIPS 140-2 or 140-3?
3. Which TLS versions and SSH algorithms does the endpoint accept today?

What does MFT cost to own?

The licence or subscription is the smallest part; staff time for patching, monitoring, partner onboarding and audit preparation usually costs more over three years. Count both before comparing quotes.

Self-hosted MFT adds servers, backup, a DMZ or gateway, and the hours to keep it all patched. SaaS replaces most of that with a subscription, so check how it’s priced: per user, per guest, per gigabyte, per transfer or per connection. A low entry price with per-guest fees can cost more than a higher flat plan once partners join.

Our guide to retiring an in-house server has a calculator that totals cash and hours over three years, with sourced defaults you replace with your own numbers.

How do you move off a legacy FTP server or MFT platform?

Inventory every partner, script and credential first, run old and new side by side, and switch partners over in groups you can roll back. Rushed cutovers break production transfers, not security.

List every account and what connects to it. Move the hostname if it’s a public name you own. Issue new host keys rather than copying old ones. Let partners keep their SSH key pairs where the key type is supported. Test each partner’s first connection before you switch, and keep the old server read-only until the last partner has moved. Our guide to retiring an in-house server walks through each step of the cutover.

Sharetru is cloud MFT for regulated mid-sized organizations that need people and systems on one governed platform, with audit evidence included. It isn’t for every MFT job, so this chapter lists both sides.

Where it fits

• One platform for all three channels. A web app and links for people; SFTP, SCP, FTPS, FTPeS and HTTPS for systems; a 60-endpoint REST API for software. Plain FTP is available on Sharetru Commercial, off until you turn it on, and not on Sharetru Federal.
• Partners at no seat cost. Guests are unlimited on every plan.
• Notices and clean-up built in. Email notifications on upload, download and deletion per folder, and retention rules that delete files after a set number of days.
• Evidence you can check. SOC 2 Type II Attested. HIPAA Security Rule audited annually by A-LIGN, with a BAA. Sharetru Federal is FedRAMP Rev 5 (Class C) Certified (the new name for FedRAMP Moderate), listed on the FedRAMP Marketplace under package F1311222650.
• Encryption by platform. AES-256 at rest. TLS 1.2 with FIPS 140-2 validated modules on Sharetru Commercial; TLS 1.3 with FIPS 140-3 validated modules on Sharetru Federal.
• Run for you. Sharetru patches, backs up and monitors it: a 99.9% uptime SLA (opens in a new tab), 30 days of incremental backups, and data stored in the U.S.
• A record that lasts. Logs kept 3 months on Core, 6 on Complete, 12 on Sharetru Federal and 72 with the HIPAA Support Package.
• A clean history. Sharetru has never had a security incident affecting customer data.

Where it doesn’t

People and systems have exchanged files on Sharetru since 2010. A 15-day free trial and a 60-minute demo are both open, and the conversation can start from how you move files today.

Sources

NIST National Vulnerability Database (opens in a new tab) (CVE records and CISA KEV dates for chapter 3) · CISA Known Exploited Vulnerabilities catalog (opens in a new tab) · CISA and FBI advisory AA23-158A, #StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability (opens in a new tab) · Microsoft Threat Intelligence, Investigating active exploitation of CVE-2025-10035 (opens in a new tab) · CybelAngel, Cleo CVE-2024-50623 and CVE-2024-55956 explained (opens in a new tab) · Kiteworks, Accellion’s brand name is now Kiteworks (opens in a new tab) · FedRAMP Marketplace (opens in a new tab) · NIST Cryptographic Module Validation Program (opens in a new tab) · NIST SP 800-171 and SP 800-53 · 32 CFR 170 (CMMC) · DFARS 252.204-7012 · 22 CFR 120.54 · 45 CFR 164.312 · 16 CFR 314 · PCI DSS v4 · IETF RFC 4130 (AS2) · OpenSSH release notes (scp over SFTP). Sharetru facts: the Sharetru Knowledge Base, the plan page and the product owner. Not legal advice.