Skip to main content

Fully Managed SFTPGo
as a Service

Deploy SFTPGo as a fully managed service starting at €9/mo. Get automated backups, SSL, updates, support and monitoring included.

SFTPGo is an open-source multi-protocol file-transfer server — SFTP, SCP, FTP, FTPS, WebDAV, HTTP/S, all from a single Go binary — combining the convenience of managed MFT platforms like Couchdrop or AWS Transfer Family with the control of self-hosted infrastructure.

Free 7-day trial  99.9% Uptime SLA  No credit card  Cancel anytime

Free 7-day trial  99.9% Uptime SLA
No credit card  Cancel anytime

SFTPGo

SFTPGo

STARTING AT

€9/month
Automated Backups
Monitoring
Automated Updates
Auto SSL

USAGE

Unlimited
Human Support
Custom Domains
Terminal Access
File Manager Access
Deploy in your region 21 locations worldwide
GermanyFinlandNetherlandsUKSwedenUnited StatesCanadaSingaporeJapanAustraliaBrazilSouth Africa+9 more →
SFTPGo Preview Image

ABOUT THE SOFTWARE

What is SFTPGo

SFTPGo is an open-source multi-protocol file-transfer server — SFTP, FTP, FTPS, WebDAV, and HTTP/S in a single Go binary — designed for teams that need authenticated, audit-logged file exchange with partners, customers, or internal pipelines.

Released in 2019, SFTPGo is maintained by Nicola Murino — also a Go team contributor and upstream maintainer of golang.org/x/crypto/ssh — trading as Software Engineering S.r.l. (Milan, Italy). The project is distributed under AGPL-3.0 with additional terms covering its embedded admin UI assets. The GitHub repository sits at 11.5k stars and 921 forks, and SFTPGo ships as an official offering in the AWS, Azure, and Amazon EKS/ECS marketplaces.

A typical single-instance deployment runs comfortably on 1 vCPU, 512 MB RAM, and 2 GB disk for 50–300 active users on local-filesystem or S3-backed storage. The binary is a single ~30 MB Go executable; on adequate hardware it saturates a gigabit link without special tuning. SFTPGo is in production at aerospace, finance, research, healthcare, and MSP operators per the project's own deployment notes.

FEATURES

What SFTPGo does

Eight features that make SFTPGo the open-source choice for teams replacing proprietary MFT — multi-protocol from one binary, pluggable storage, an event manager that does real work, and a REST API you can drive from your own automation.

Multi-protocol from one server

SFTP, SCP, FTP, FTPS, WebDAV, and HTTP/S concurrently from a single Go binary, with independent listener bindings and TLS configuration per protocol. No protocol-per-server fee math.

Cloud storage as first-class filesystems

S3-compatible (AWS, Backblaze B2, Wasabi, R2), Azure Blob, Google Cloud Storage, SFTP-as-fs proxy mode, HTTP-fs for custom backends, plus an encrypted local backend (cryptfs) — mountable per user or virtual folder.

Soft and hard quotas, per user and per folder

Total-size and file-count caps with aborted-upload cleanup on quota exceed. Quotas are independent for shared virtual folders, so two users can share a folder with different individual limits.

Two-factor and chained authentication

TOTP (RFC 6238), keyboard-interactive, public-key plus password chaining, SSH user certificates, per-user authentication-method policies, external auth via HTTP API or shell programs.

Six pluggable data providers

SQLite, PostgreSQL, MySQL/MariaDB, CockroachDB, bbolt (key-value), and in-memory — move from single-VM to stateless Kubernetes pod without changing the application. We default to PostgreSQL.

Built-in defender for brute-force protection

Configurable rate limiting, per-IP automatic blocking with TTLs, optional GeoIP filtering via plugin, trusted-IP carve-outs for known partner ranges. We tune blocking thresholds during onboarding.

Event Manager with workflow automation

Pre/post action hooks on upload, download, delete, rename, mkdir; scheduled retention rules; PGP encrypt and decrypt actions; dynamic user provisioning from identity-provider templates; searchable event history.

Native REST API and admin web UIs

Full OpenAPI-described REST surface for users, groups, folders, quotas, backup/restore, and live-connection management. WebAdmin for operators, WebClient for end users with shares, dark mode, and in-browser file management.

WHAT'S ALWAYS INCLUDED

Every app. Fully managed.
Nothing extra to pay for.

Every app you deploy includes the full managed service — security, backups, updates, and support from day one.

Automatic updates and patches

Apps run the latest stable version. Security patches applied silently, with rollback if needed.

Daily off-site backups

Multiple daily backups in redundant off-site locations. One-click restore if anything goes wrong.

24/7 uptime monitoring

Continuous monitoring with instant alerting. We respond before you notice.

SSL, firewall, DDoS protection

Auto-renewing SSL, hardened firewall rules, DDoS mitigation on every deployment.

Performance and scaling

We monitor resource usage continuously. When your app needs more headroom, we flag it and upgrade with your explicit approval.

Dedicated engineering support

Real engineers on chat. DNS, SMTP & migration help. All included in €9.

WHY MANAGED

Why teams pick managed SFTPGo

Buyers are landing on managed SFTPGo in 2025–2026 because the Cleo MFT zero-day chain (CVE-2024-50623 and CVE-2024-55956) sent Cl0p ransomware tearing through proprietary managed-file-transfer estates, and the AWS Transfer Family alternative still starts at $216/month per protocol endpoint.

Between October 2024 and January 2025, Cleo Harmony and VLTrader zero-days were chained into remote code execution; Cl0p claimed 66+ named victims, security researchers logged 200+ organisations on the leak site in December 2024 alone, and the Hertz breach attribution in April 2025 kept the story running through Q2. The pattern — opaque proprietary MFT, slow disclosure, broad downstream impact — pushed security teams at banks, logistics 3PLs, sequencing labs, and broadcasters toward open-source file transfer they can read, configure, and operate. AWS Transfer Family is the obvious cloud-native swap, but at $0.30/hour per protocol per endpoint plus $0.04/GB ingress and egress, a modest 5-user / 500 GB-per-month workload runs close to $280/month before storage. SFTPGo on managed infrastructure clears the same workload at a flat price.

Running SFTPGo yourself is the third option, and most teams underestimate it. The default SQLite data provider locks under concurrent connections — documented in GitHub Issue #202 — has no CLI write path (operators must use the REST API), and cannot live on a stateless container, so the moment you move from a single VM to a Kubernetes pod or an HA pair you have to migrate the data provider or accept downtime. TLS certificates have to renew across four separate listener structs (sftpd, ftpd, webdavd, httpd), each polling for cert changes only every 8 hours unless you wire post-renewal hooks yourself. The defender wants tuning before it locks out a real partner's batch IP. None of this is hard. It just isn't free.

REVIEWS

Hear from customers ​like you​​​​​​​

Successful businesses and professionals around the world rely on DANIAN every day

USE CASES

Three teams who run SFTPGo on DANIAN

These are representative team types we set up most often. Each starts with the same flat €9 plan.

12-PERSON LOGISTICS 3PL

Replacing AWS Transfer Family for retailer-partner EDI exchange

Germany region. One virtual folder per retailer partner (40 partners), each rooted on Backblaze B2 EU object storage with per-folder quotas (5 GB soft, 8 GB hard). Event Manager pre-upload hook runs an ANSI X12 schema sanity check via HTTP webhook before files land. Post-upload event ships a Kafka notification to their TMS. SAML SSO via Entra ID for the internal team; SSH-key-only auth (no passwords) for partner endpoints; defender carve-outs for known retailer IP ranges.

6-PERSON POST-PRODUCTION HOUSE

Replacing Aspera-on-Cloud for broadcaster rough-cut delivery

US region. Local-FS NVMe backend; bandwidth throttling set at 800 Mbps per user so an 80 GB ProRes upload doesn't starve concurrent review sessions. Per-user soft 500 GB / hard 750 GB. WebDAV listener enabled so editors drag-and-drop in Finder; FTPS disabled. Public-share URLs for one-way rough-cut delivery to broadcaster clients without giving them accounts. OIDC via Google Workspace; Slack webhook on upload-succeeded events; 90-day searchable event history for chain-of-custody.

4-PERSON ACCOUNTING FIRM

Replacing a Dropbox shared-folder workflow for year-end client uploads

France region. One SFTPGo group per client (60 clients), each with a chrooted home and 2 GB hard quota. Mandatory TOTP for all client logins; time-based access restrictions (Mon–Fri 06:00–22:00 local) to cut bot brute-force at the schedule layer. Public-upload shares with password, email verification, and 7-day expiry for clients who refuse to install an SFTP client. Pre-upload hook rejects files > 100 MB. Their QuickBooks/Karbon stack pulls files via SFTPGo's REST API rather than touching SFTP.

COMPARISON

Four ways to run SFTPGo

Compare the proprietary MFT path, the self-hosted VPS path, the home-server path, and managed SFTPGo on DANIAN — on real numbers, not marketing tiers. The math holds for a 5-user file-exchange workload moving 500 GB per month.

 PATHCOST AT 1 / 5 / 10 USERSONGOING OPERATIONSTRADE-OFFS
Proprietary SaaS
Couchdrop / AWS Transfer Family
$50 / quote-only / quote-only

AWS Transfer Family: ~$216 SFTP-only + $0.04/GB both ways
Vendor manages everything; you write IAM glue around itPer-protocol and per-secret pricing on AWS; mid-tier and above are quote-only on Couchdrop; closed source on both
Self-host on a VPS
SFTPGo on a $24/mo production VPS
$24 / $24 / $24

Plus the operator hours behind it
You patch, back up, monitor, renew TLS across 4 listeners, tune defender, migrate off SQLite at scaleCheapest sticker price; real cost is engineering hours; PostgreSQL setup and TLS renewal pipeline are on you
Home server
Synology DS923+ or HP ProLiant ML30
$650 one-time + $8/mo electricity

Plus the partner question of "is this on a residential IP"
You're the data centre — backups, UPS, ISP failover, network exposureOwned hardware; residential IP fails most partner KYC checks; not suitable for B2B file exchange with banks or broadcasters
DANIAN Managed SFTPGo
€9 / €9 / €9

Flat — no per-user, no per-protocol surcharge
We patch, back up, monitor, renew TLS, run PostgreSQL, tune the defender, answer the operator question at 2 a.m.Predictable monthly cost; you keep configuration control; export everything if you ever leave

Pricing for Couchdrop verified live at couchdrop.io/pricing in May 2026; mid- and top-tier plans are quote-only. AWS Transfer Family pricing verified at aws.amazon.com/aws-transfer-family/pricing. VPS path assumes a $24/mo production-class VPS; home-server hardware list price for a Synology DS923+ as of May 2026.

BY INDUSTRY

SFTPGo for specific industries

Four industries where SFTPGo is the open-source fit because each puts specific demands on file transfer — regulated transport, audited retention, partner-IP tolerance, and cryptographic constraints. Configuration choices differ per industry; the operator answer should not be the same paragraph word-swapped.

NACHA Operating Rules require encrypted transport and authenticated endpoints for ACH file exchange. SWIFT Customer Security Controls Framework v2025 (baseline controls 2.4A and 2.6) governs data-flow security for correspondent banking. On DANIAN we run SFTPGo with the defender in enforcement mode (24-hour IP block TTL), mandatory dual-factor authentication (SSH key plus TOTP) for every user, FTPS disabled at the listener level, PostgreSQL with read-replica failover, and an Event Manager rule routing every successful upload to immutable S3-with-Object-Lock storage for non-repudiation.

A community bank's vendor-ops team receives nightly ACH return files from its core processor: the pre-upload hook verifies the filename matches the ACH convention <ABA>-<YYYYMMDD>-RET.ach; the post-upload hook PGP-decrypts and forwards a control-totals webhook to the bank's reconciliation engine. Typical nightly window: 20–80 ACH files per partner at 5–40 MB each, PGP-encrypted at rest, TLS 1.2+ in transit. Audit-log retention runs to 7 years per NACHA §2.15 and FFIEC guidance.
Sequencing core facilities and clinical-research sites move whole-genome FASTQ.gz output between partner sequencing instruments and downstream Nextflow or Snakemake pipelines, with HL7 v2 messaging on the orchestration side. On DANIAN we run SFTPGo with TLS 1.2+ mandatory, AES-256 at-rest encryption via SFTPGo's cryptfs local backend, per-user logs shipped off-instance hourly to a long-retention SIEM tier, and no shell hooks — only HTTP-webhook hooks to allow-listed internal endpoints.

Each partner instrument lives in its own chrooted SSH-key user mapped to an S3-compatible bucket with Object-Lock-on-write. An Event Manager rule on upload triggers a Nextflow pipeline via webhook. Typical single-file sizes run 8–60 GB for whole-genome FASTQ; quota per partner instrument sits at 2 TB soft / 3 TB hard; sustained per-stream throughput is 300–800 Mbps. Patient-data log retention follows the longer of operator policy or applicable regulation, typically 6 years minimum.
Broadcaster delivery specifications — DPP AS-11 (the UK and European broadcaster delivery standard) and IMF (Interoperable Master Format, SMPTE ST 2067) — define exact file-naming, sidecar XML, and checksum manifest conventions. There is no single regulator, but contract-level penalties for delivery failure are severe. On DANIAN we run SFTPGo on a local-FS NVMe backend (cloud-storage backends add review-room latency editors will not tolerate), per-user bandwidth caps with separate read and write limits so a 200 GB upload does not starve concurrent review downloads, WebDAV enabled for Finder and Explorer mounts, and public-share links with password and download-count limits for one-off broadcaster deliveries.

A post house delivers a 4-hour HEVC master (~180 GB) plus an XML sidecar to a broadcaster's SFTPGo virtual folder; the Event Manager on upload-succeeded verifies the accompanying .md5 checksum, applies PGP encryption if the broadcaster's contract requires it, and emits a Slack notification to the broadcaster's traffic department. Routine single-file sizes 50–250 GB; occasional IMF packages exceed 500 GB. Delivery SLAs typically 24–48 hours from picture-lock; required throughput ≥1 Gbps sustained.
CMMC 2.0 Level 2 (built on NIST SP 800-171 Rev 2) governs controlled unclassified information for defense contractors, specifically practice SC.L2-3.13.8 (cryptographic protection of CUI in transit) and AU.L2-3.3.1 (audit-record creation and retention). For international contractors, ITAR §120.54 defines transfer events. On DANIAN we provision the instance in a US-only or EU-only region of your choice at provisioning time; restrict SSH and TLS to FIPS-approved cipher suites via SFTPGo's tls_cipher_suites and kex_algorithms configuration fields; integrate SSO via Okta or Entra ID with PIV/CAC support; run the defender in strict per-IP rate-limit mode; and disable public shares and the FTPS listener.

A defense subcontractor receives CUI-marked engineering drawings (encrypted ZIP) from a prime contractor: the virtual folder is rooted on encrypted local storage, the pre-upload hook verifies the filename carries the //CUI//SP-PROIN marking, and the event trail ships to the prime's audit collector via syslog-over-TLS. Retention runs to 3 years for NIST 800-171 baseline (longer per contract); per-user file count caps typically 10,000 files / 50 GB to keep search response under 2 seconds.

FAQ

Frequently asked questions

Everything teams ask before signing up — answered straight, without sales speak.

Three groups: technical setup, migration, and how DANIAN works as a service.

01

Technical and configuration

We run PostgreSQL as the data provider on every DANIAN-managed SFTPGo instance, not the upstream SQLite default. SQLite is fine for a single VM, but it locks under concurrent connections, has no CLI write path, and cannot live on a stateless container.
Yes — this is the most common production failure we see on inbound migrations. It is documented in SFTPGo GitHub Issue #202: SQLite on a mounted container volume locks under concurrent access. Every DANIAN-managed instance ships on PostgreSQL with a read replica from day one, so you do not encounter the lock.
Yes. We set apply_proxy_config and client_ip_proxy_header so the defender sees the real client IP rather than the proxy's. Failed authentication attempts and rate-limit violations are attributed to the originating IP, blocks land on the right address, and your known partner IP ranges can be added to the defender's trusted list so batch jobs are never accidentally locked out.
SFTPGo enforces both soft and hard quotas at upload time. When a user hits the hard cap mid-transfer, the upload is aborted, the partial file is removed, and a quota_exceeded event fires through the Event Manager. We expose that event as a webhook destination, so your monitoring stack can alert the user (or you) before they hit the cap rather than after. Quotas can be set per user, per virtual folder, or both — the lower limit wins.
We do not cap upload size by default — the SFTPGo default of 0 (unlimited) stays unless you ask us to lower it. The practical ceiling is your instance's disk allocation or your S3 bucket policy if you use an object-storage backend. Single-file uploads of 250 GB are routine on media-delivery instances; we have customers regularly moving 60 GB FASTQ.gz files for sequencing pipelines.
Yes — all three cloud-storage backends are first-class SFTPGo features and we wire them up in your dashboard. S3-compatible covers AWS S3, Backblaze B2, Wasabi, Cloudflare R2, and any other S3 API endpoint. Azure Blob and Google Cloud Storage are configured with your service-principal or service-account credentials. You can also mix backends per virtual folder — partner A on S3, partner B on Azure, partner C on local NVMe — within the same instance.
SFTPGo Community (the version we ship by default) does not include native AS2 — it covers SFTP, SCP, FTP, FTPS, WebDAV, and HTTP/S. If your retail or banking partners require AS2 specifically, talk to us first; SFTPGo Enterprise adds AS2-adjacent integrations via the Event Manager, and for some workflows a small AS2-translator sidecar in front of SFTPGo is a cleaner fit than swapping the whole stack.

02

Migration and onboarding

We can activate your app on your own custom domain/subdomain. Examples: mydomain.com, anyword.mydomain.com.
Or, on our randomized free subdomain. Example: 963.apps.danian.cloud
If you wish to use a custom domain/subdomain, select that option when ordering your app (or notify us later). We will send you the required DNS records and if needed, our tech team will modify them for you.
21 datacenter locations across six continents. You choose the region at provisioning. Application data sits in the region you choose; pick whichever is closest to your users or matches your data-residency preference.
Yes. Request a region migration from the dashboard and we run the move in the background. The system emails you when the migration completes; total transfer time depends on data volume but typical instances finish in a few hours. There is no extra charge for a region change.
Yes. Full data export is available at any time, in a portable format you can bring to any infrastructure.
SFTPGo supports OIDC and external authentication via HTTP API. We configure your identity provider (Okta, Microsoft Entra ID, Google Workspace, or any standards-compliant OIDC provider) for the WebAdmin and WebClient UIs. SFTP/FTPS partner endpoints typically stay on SSH-key authentication rather than SSO, since most automated B2B transfers run from service accounts.

03

Billing, support, and platform

€9 covers everything we do for that app: hardware in the region you choose, daily off-site backups with one-click restore, automatic security patches and version upgrades, 24/7 monitoring, SSL and firewall, and engineering support on Email/LiveChat. There are no setup fees or hidden line items. For more info see our Pricing page.
If you decide to continue, we charge €9/app/month from day 8. If you don't, the trial ends and you can export your data. No card is required for the trial, and we never auto-charge you without explicit consent.
No. The €9/month is flat regardless of how many users log into your app. Add 5 users or 50; the price doesn't change.
24/7 Live chat and email support, both staffed by engineers who run the systems. We handle DNS configuration, SMTP setup, app integrations, performance tuning, troubleshooting, and migration help. Response time is typically under an hour. There is no tier system — every customer gets the same support.
Yes. Cancel from the dashboard. We don't charge a cancellation fee, we don't lock data, and we will export your data to you on request before deletion. data to you on request before deletion.
Every customer instance is backed up daily to a separate region from the primary. We test restores. You can request a restore at any backup point within the retention window — usually 7 days for daily backups.
Your application data sits in the region you choose at provisioning — 21 datacenter locations across six continents. Account-level data (billing, account email, support ticket history) is processed centrally. Application data region is picked by you, per app.
99.9% uptime SLA on every app, every tenant. Service credits are documented at danian.co/service-level-agreement. The status page is located at status.danian.co.
When your tenant approaches the resource ceiling — the base tier holds 1 vCPU/RAM, 30 GB storage — we notify you. Resource upgrades happen with your explicit consent; we will not upgrade your tenant or charge you without it.
We wait. We don't suspend the app or delete your data on the first failed charge. We email you, you fix the card on file, and we continue.
Invoices can be downloaded from the billing dashboard in PDF the day each charge succeeds. EU VAT is added where applicable and the VAT-reverse-charge regime applies for VAT-registered businesses with a valid number.
150+ open-source apps across automation, team chat, file sync, analytics, AI, password management, email marketing, dev tools, project management, smart home, CMS, and federated social. See the full catalog →
Yes. Every instance comes with a web-based terminal and a file manager in your DANIAN management dashboard. Useful for managing your data and customizations.
Resources scale with your usage. If your app needs more vCPU, RAM, or storage, we add it — and we ask first before any change to your plan. €9 is the floor; resource-heavy workloads may price higher, but you'll always know in advance.
Yes. We have both a Partner program and an Affiliate program available. Anybody can sign up.
No contract. No minimum commitment. Cancel anytime from the dashboard with one click. The 7-day free trial requires no credit card. After the trial converts to paid, you can still cancel at any month without notice or penalty.

DEPLOY IN YOUR REGION

21 datacenter locations on six continents

Pick the region closest to your users.

United States, Germany, Finland, Singapore, Australia, Brazil, Canada, Netherlands, UK, Spain, Italy, France, Sweden, Malaysia, India, Japan, Mexico, Poland, South Korea, Chile, South Africa and more coming soon

Global Reach Map

Try managed SFTPGo for 7 days

No card. Cancel from the dashboard.