Manufacturing and engineering
Send drawings out, get certs back. Keep every exchange on the record.
Sharetru is one exchange point for the shop: people use links and the web app, your systems use SFTP and the API, and every transfer is logged to an account. Sharetru Commercial for commercial work; Sharetru Federal for exchanges that carry CUI (controlled unclassified information, such as the marked drawings in a defense contract) or ITAR data.
- Sendan RFQ or release package to a supplier by link
- Collectquotes and certs back through a drop-off link
- ConnectERP, PDM and QMS over SFTP, FTPS, SCP or the API
- Trackevery upload and download, logged to an account
15-day free trial, Commercial or Federal · Unlimited guests on every plan · No file-size limit beyond your storage
Prefer a walkthrough? Request a 60-minute demo on a live site with your own files.
HX220-rev-C.step14.2 MBOutHX220-rev-C.pdf1.1 MBOutCoC-HX220-lot-0417.pdf0.8 MBIn
Bound to quotes@castpartner.com. A forwarded copy of the link opens for no one else.
Not bound to one address. Anyone who opens it signs in, so every open is logged to an account.
| Time | Event | File | Account |
|---|---|---|---|
| 09:14 | Upload | CoC-HX220-lot-0417.pdf | guest m.ruiz@castpartner.com |
| 08:52 | Download | HX220-rev-C.step | svc-qms · SFTP |
Where it sits
Where does Sharetru sit beside what the shop already runs?
Sharetru sits at the edge of the shop: links and the web app for people, SFTP and FTPS for systems, a REST API for software. Your PDM stays the system of record and your ERP keeps running the schedule; what crosses the shop’s boundary goes through Sharetru.
Replacing an FTP server or an MFT platform? The automation page covers how your scheduler and scripts run transfers against Sharetru, and the plan page covers what each plan includes.
People: links and the web app.
Customers and suppliers open a link in a browser, register once as a guest, and send or receive from the folder you chose. Guests are free, on every plan: send, collect, view-only. Link-based file sharing
Systems: SFTP, FTPS, FTPeS and SCP.
Your ERP, PDM and QMS connect with the SFTP client or library they already have, on a service account with an SSH key. Your scheduler runs the job; Sharetru is the endpoint. Protocols
Software: a REST API with 60 endpoints.
Users, groups, folders, files, uploads, shares, permissions, network rules and activity logs, over JSON:API with an API key, documented in OpenAPI 3.0. Developer docs
The problem
A drawing leaves the shop a different way every time
Email for the customer who asked for a PDF. A Dropbox link for the supplier who needs the STEP. The FTP server for the two partners who script against it. A USB stick when the assembly is too big for any of them. Each one works. None of them leaves a record you could hand to a customer’s auditor, or to a prime.
Three jobs, three people, one cause: the exchange isn’t routed through anything that keeps the record.
See an exchange on Sharetru-
IT · the server nobody wants to own
The FTP server works, and that is the problem.
It was built by someone who has since retired or moved on. It needs a firewall exception and a patch window, and the partners who connect to it would complain if anything changed. So it stays — and so does every account on it.
Fixed by a hosted SFTP, FTPS and SCP endpoint your partners connect to with the clients they already use, patched by Sharetru, with every sign-in and transfer logged to an account.
-
Quality and purchasing · which rev does the supplier have?
Drawings and certs travel by email, and nobody can say which revision went where.
The RFQ went out as an attachment, the quote came back in a reply, and the cert arrived three weeks later in someone’s inbox. When a part comes back wrong, the question is which rev the supplier worked from — and the answer lives in six mailboxes.
Fixed by one folder per supplier, links that expire, a drop-off link for what comes back, and a log that shows the file, the account and the time.
-
Compliance and sales · the questionnaire
A customer’s security questionnaire asks how technical data is protected, and the honest answer is “it depends who sent it.”
A new customer’s vendor review, a prime’s flow-down clause, an ITAR attestation on a job you have already won: each asks the same question, and the shop’s answer is a list of habits.
Fixed by one route for what crosses the boundary, controls set by an administrator rather than remembered by a sender, and the record to show for it — on Sharetru Federal when the job carries CUI or ITAR data.
A supplier exchange
What does a supplier exchange look like on Sharetru?
A supplier exchange on Sharetru is an outbound share for what you send and a drop-off link for what comes back, all of it logged. Below, one RFQ goes out to a casting supplier and the quote and certificate of conformance come back.
The names and files are illustrative; the steps are the product’s. No file travels by email, and nothing is installed on the supplier’s computer. On Sharetru Commercial a supplier registers with a password and, if you require it, a code by email, text or app. On Sharetru Federal every user who signs in with Sharetru credentials, whether registered or guest, must use a Time-based One-Time Passcode (TOTP) authenticator app; staff who sign in through your identity provider use its MFA instead.
An RFQ out, a quote and a certificate back
Purchasing sends a casting supplier the RFQ for part HX220 at revision C. The supplier quotes, wins the job, and sends the certificate of conformance with the first lot. Purchasing and quality see every step in one folder and one log.
Purchasing creates an outbound share from
/Suppliers/CastPartner:HX220-rev-C.step,HX220-rev-C.pdfandRFQ-2291.pdf. Up to 50 files or folders per share, with no file-size limit beyond your storage.Sharetru sends the link to quotes@castpartner.com — a domain your site’s allow-list permits — with an expiry of 14 days and a limit of 5 uses.
The estimator registers once as a guest with that address, a password and MFA if your site requires it, then downloads the package. A forwarded copy of the link opens for no one else.
On the record: the share, the recipient, and each download, each with a time and an account.
The same supplier gets a drop-off link into
/Suppliers/CastPartner/Inbound. It is upload-only: the supplier never sees the folder, or anything else on your site.The quote lands, and ten days later the certificate of conformance for lot 0417. A notification reaches the folder’s watchers on each upload.
Quality pulls the certificate over SFTP into the QMS, or opens it in the browser. The folder’s retention rule removes the RFQ package 90 days after it was uploaded.
On the record: each upload with the guest’s account, each download with the service account or the person.
Commercial manufacturing · customers in
A customer’s engineering change arrives as a package, not an email.
The customer’s engineers drop the new revision through your inbound link; your PDM pulls it over SFTP on its next run; the old revision stays in the folder until your retention rule removes it.
Defense supply chain
A prime’s drawing carries a distribution statement.
Aerospace & Defense pageRun that exchange on your Sharetru Federal site: the same links and SFTP, with MFA for every opener — a TOTP authenticator app for anyone on Sharetru credentials, the prime’s engineer included; your identity provider’s MFA for staff on SSO — and administration by U.S.-citizen staff only. Whether a drawing is CUI is your determination.
Outsourced operations · suppliers out and back
An outside process needs the traveler and sends back the cert.
Plating, heat treat, NDT: one folder per processor, an outbound share for the traveler and drawing, a drop-off link for the cert. The processor needs a browser, not an account on your network.
How it works
How does one exchange point serve both people and systems?
Sharetru keeps one set of folders, rules and logs, reached by people through links and by systems over SFTP or the API. The figure follows five transfers across one shop’s boundary — three by people, two by systems — and a sixth, a forwarded link, which is refused.
The record at the bottom is what a customer’s auditor, or a prime, is given: every event with its file, its account, its time and the path it took.
Swipe sideways to see it all →
Illustrative. One morning at a fictional shop. A link is bound to the recipient when Sharetru sends it; a link you copy and send yourself is not, but every opener still signs in, so every open is logged to an account. Systems connect with a service account and an SSH key; per-user IP rules come with the Complete plan.
Start with the people who send the files.Give a few of them a login on a 15-day free trial, Commercial or Federal — purchasing, quality, or the whole engineering department — and request a demo. We will show them how it works.
Alongside GCC High
We moved to GCC High. Can we still share files with suppliers?
Yes — Sharetru runs alongside GCC High as the governed way in and out, so suppliers never need a seat in your tenant. GCC High stays the enclave where cleared staff collaborate; Sharetru does one job at its edge: move files across the boundary in both directions.
Sharetru is not inside your tenant. Staff move files through the web app or SFTP, partners through links, and your scripts can push files into Sharetru and pull them into Azure Storage through the REST API. The tenant provides identity (Entra ID), logging (Sentinel) and mail; exchanges that carry CUI run on Sharetru Federal.
Illustrative. Sharetru Federal is FedRAMP Rev 5 (Class C) Certified (the new name for FedRAMP Moderate), a SaaS within the GovPoint Cloud Services boundary (package F1311222650); it runs alongside GCC High, never inside your tenant. Sentinel forwarding and Microsoft 365 mail are built-in integrations; the Azure Storage path is your scripts calling the REST API, not a built-in connector.
-
Admin load
Partners never enter the enclave.
No cross-cloud guest configuration, no per-external-user licensing, no eligibility check and offboarding task for every sub and supplier. Partners keep Sharetru-native credentials, so no external identity enters your directory.
-
Identity
Hybrid authentication, chosen per user.
Entra ID replaces the Sharetru login for the staff you choose, on a commercial or a GCC High tenant: you build a security group, only its members can authenticate, and their MFA is your identity provider’s. Everyone else, suppliers included, signs in to Sharetru with its own credentials, never to your tenant, and every grant beyond a first folder is assigned by an administrator.
-
Visibility
External file movement lands in Sentinel.
Sharetru forwards its audit trail to Microsoft Sentinel as the same syslog (CEF) stream, through a data collection endpoint in your workspace — a built-in integration, no middleware — so the SOC watches the boundary from the same pane as everything else, and notifications to partners go out through your own Microsoft 365 mail domain.
Commercial and defense work
We run commercial and defense jobs. Which site do we need?
Run commercial work on Sharetru Commercial and exchanges that carry CUI or ITAR data on Sharetru Federal; the interface, folders and protocols are the same. A shop that does both can run two: Commercial for general work, Federal for defense contracts. A Federal site can carry commercial work too, so one is possible; two is what we recommend.
FAR 52.204-21’s basic safeguarding for federal contract information sets no cloud-authorization requirement; DFARS 252.204-7012 does for CUI. Which of your exchanges carry CUI is your determination, and the Aerospace & Defense page covers the defense side in full.
Commercial work, proprietary drawings and federal contract information (FCI)
For shops exchanging proprietary drawings, RFQs and quality records with commercial customers and suppliers, and answering a customer’s security review with a SOC 2 Type II report, on request under NDA, and the record.
- Core and Complete plans — Core with 10, 20 or 30 registered users and 10, 20 or 30 GB; Complete with unlimited users from 100 GB; guests free on both; no file-size limit beyond your storage
- SFTP, SCP, FTPS, FTPeS and HTTPS; plain FTP available where a legacy system needs it
- MFA by authenticator app, email or SMS, optional; SSO for staff through Entra ID or another identity provider
- FIPS 140-2 validated encryption; TLS 1.2 on every connection
- Logs kept 3 months on Core and 6 on Complete, forwarded to your SIEM as a syslog (CEF) stream
- 15-day free trial from the plan picker, no call required
Exchanges that carry CUI or ITAR technical data
For the jobs where a prime’s drawing carries a distribution statement, an ITAR attestation is on file, or DFARS 252.204-7012 is in the contract — on a service your assessor can verify. Prefer a walkthrough? Request a Federal demo.
- A FedRAMP Rev 5 (Class C) Certified SaaS within the GovPoint Cloud Services boundary — package F1311222650 on the FedRAMP Marketplace
- MFA required: a TOTP authenticator app for every user on Sharetru credentials — staff, suppliers’ guests and the prime’s engineer alike; staff on SSO use your identity provider’s MFA. Sharetru’s own sign-in does not support PIV/CAC or hardware keys
- FIPS 140-3 validated encryption; optional dynamic watermarking on files a guest views through a link
- U.S.-citizen staff, U.S. soil — administered only by U.S. citizens, which satisfies ITAR’s U.S.-person rule (22 CFR 120.62); data stays in the U.S.
- Logs kept 12 months; a shared responsibility matrix at the NIST SP 800-171 objective level, on request during the trial
- Your plan plus the Sharetru Federal package — an add-on to Core or Complete, with the same user bands and free guests; $200 a month on the plan page today; 15-day free trial from the plan picker
- Everything else is the same: folders, links, SFTP and the API
SIEMs you can send Sharetru logs to · a syslog (CEF) stream from every plan
- Splunk
- Microsoft Sentinel
- IBM QRadar
- CrowdStrike
- Rapid7
- Sumo Logic
- OpenText ArcSight
- ManageEngine Log360
- Securonix
- LogRhythm
- Arctic Wolf
- Wazuh
FAQ
Questions shops ask before they send the first drawing
Suppliers and customers
Can a supplier open a link without a Sharetru account?
A supplier opens a link as a guest: they register once with an email address, a password and MFA if required. When Sharetru sends the link, only its recipient’s address can register. Guests are free and unlimited on every plan and see only what is shared to them; converting one to a registered user is your choice, never ours.
What does the supplier see?
The link, by email from your Sharetru site or pasted by you, and then only the folder you shared. They register once with an email address and a password; files show Download when the share allows it; a drop-off page takes their uploads and confirms each on screen. The notification email goes to your watchers, not the supplier.
Can a supplier send us files without seeing anything else on our site?
Yes — a drop-off link is upload-only: the supplier sends files into the folder you chose and never sees the folder or anything else. Expiry applies to inbound links too, and an administrator may let one run with no expiry.
What happens if a supplier forwards the link?
When Sharetru sends the link, it is bound to the recipient’s address, and a forwarded copy opens for no one else. A link you copy and send yourself is not bound to one address, but anyone who opens it must sign in, so every open is still logged to an account.
How do we know which revision the supplier has?
The record shows each upload and download with its file, account and time; the Shares list shows what each link holds and when it expires. Keep one folder per supplier, send revisions as new shares, and let the folder’s retention rule remove what is superseded.
Systems and files
Can our ERP or PDM pick up files automatically?
Yes — your ERP, PDM or QMS connects over SFTP, FTPS, SCP or the API with a service account and SSH key, on your schedule. Sharetru has no scheduler of its own; it is the endpoint your systems and your partners’ systems connect to.
What does a partner that connects over SFTP count as?
A registered user, with a password or an SSH key, counted in the band like your own service accounts. A partner whose system connects over SFTP instead of opening a link gets an account of its own; browser guests are always free, on every plan.
Which CAD and CAM file types can we send?
Any file type: Sharetru places no restriction on file extensions and no file-size limit beyond your site’s storage. Send .step, .iges, .dwg, .dxf, .catpart, .sldasm, .nc, .stl, .gbr and whatever a customer sends next; uploads are scanned for malware.
Does Sharetru replace our network drive or PDM?
No — Sharetru is the exchange point at the shop’s edge; your PDM stays the system of record and your network shares stay put. There is no drive mapping and no co-editing: what crosses the boundary goes through Sharetru, and engineering keeps working where it works today.
Does Sharetru encrypt files with PGP or support AS2 for EDI?
No — Sharetru encrypts every connection in transit and every file at rest, but it does not apply PGP to files or speak AS2. If a partner requires file-level PGP, you encrypt before upload and hold the keys — raise it on the first call rather than at the end of a trial.
Defense work and plans
Is a drawing from a prime always CUI?
No — whether a drawing is CUI depends on its markings and your contract, and the determination is yours, not Sharetru’s. A distribution statement or an export-control marking is the usual signal. When it is CUI, DFARS 252.204-7012 applies and the exchange belongs on Sharetru Federal; the CMMC page covers the rest.
Does Sharetru replace SharePoint in GCC High?
No — GCC High stays the enclave where cleared staff collaborate; Sharetru is how files cross the boundary to partners without tenant accounts. Staff sign in to Sharetru through Entra ID, partners sign in to Sharetru directly, and the audit trail forwards to Microsoft Sentinel.
Can we require approval before someone shares a drawing?
Not as an approval step: an administrator decides which users may share at all, and the domain allow-list and block-list decide where links may go. Expiry, use limits and view-only narrow each link further, and every share is on the record from the moment it is sent.
How long are logs kept, and can our SIEM receive them?
Logs are kept 3 months on Core, 6 on Complete and 12 on Sharetru Federal, and your SIEM receives them as a syslog (CEF) stream. The stream covers views, uploads, downloads and permission changes, each tied to a user, guest or system account, from every plan; the twelve above are the ones Sharetru names, and any syslog-capable SIEM works.
What does it cost to add a supplier?
Nothing: suppliers and customers are guests, and guests are free and unlimited on every plan. Registered users — your own staff and service accounts — come in bands of 10, 20 or 30 on Core and without limit on Complete; the plan page has the figures.
Get started
See an RFQ go out and a certificate come back — and the record it leaves.
Every new signup, Commercial or Federal, includes a 15-day free trial with links, drop-off links, SFTP and the API included. Prefer a walkthrough? We will run one supplier exchange on a live site with your own files, then show you the log.
Sharetru provides the software; you make the move at your own pace. If you want help with the move, we introduce a migration partner; the partner’s fee is theirs. Book a requirements session, or read the sharing guides first.
Details on this page are drawn from the Sharetru Knowledge Base (Link Based File Sharing, Sitewide Settings, 3rd Party Transfer Clients), the Sharetru plan comparison, the developer documentation and FedRAMP Marketplace listing F1311222650. Product screens on this page are illustrative.