Managed SFTP, without a server

"Serverless SFTP" sounds like a contradiction — SFTP is, after all, a stateful protocol over SSH. The trick is where the file goes. A traditional SFTP server is a long-lived box with a filesystem: you provision it, harden it, rotate its keys, watch its disk fill, and eventually answer a 3am page when it falls over. FTPasHTTPS keeps the SFTP front door but removes the box behind it. The connection is terminated for you, and the bytes are handed to your HTTPS endpoint as they arrive.

How a serverless SFTP endpoint works

1. You create a server in the dashboard and pick a protocol — SFTP with SSH key auth, FTPS over TLS, or plain FTP for legacy clients.
2. You add each partner as a user and paste their SSH public key. No shell accounts, no OS users.
3. A partner connects and runs STOR. FTPasHTTPS streams those bytes into an HTTPS POST to your configured endpoint.
4. Your endpoint replies. 200 becomes 226 Transfer complete for the client; a 5xx becomes 451 Action aborted.
5. Webhooks are HMAC-SHA256 signed; failed deliveries retry with exponential backoff and land in a dead-letter queue. Everything is logged.

Add a user + receive the upload

Provisioning a partner is two pieces of config: the user with their key, and the endpoint that receives their files.

# Serverless SFTP server config
{
  "protocol": "sftp",
  "host": "sftp.yourcompany.com",     # custom domain (Professional+)
  "users": [
    {
      "username": "acme-logistics",
      "auth": { "type": "ssh-key", "publicKey": "ssh-ed25519 AAAAC3Nz..." }
    }
  ],
  "endpoint": {
    "type": "webhook",
    "url": "https://api.yourcompany.com/ingest",
    "hmac": { "algorithm": "sha256", "secret": "${WEBHOOK_SECRET}" }
  }
}

Your endpoint verifies the signature and reads the file from the request body — here in Node, but any HTTP framework works:

// POST /ingest  — the SFTP upload arrives as the request body
import { createHmac, timingSafeEqual } from "node:crypto";

export function ingest(req, res) {
  const sig = req.header("X-FTPasHTTPS-Signature");
  const mac = createHmac("sha256", process.env.WEBHOOK_SECRET)
                .update(req.rawBody).digest("hex");
  if (!timingSafeEqual(Buffer.from(sig), Buffer.from(mac))) {
    return res.status(401).end();          // -> client sees 451
  }
  const name = req.header("X-FTPasHTTPS-Filename");
  void process(name, req.rawBody);
  return res.status(200).end();            // -> client sees 226
}

Serverless endpoint vs. running your own SFTP box

Concern	Self-hosted SFTP server	FTPasHTTPS serverless endpoint
OS & daemon patching	Yours, forever	Managed for you
Scaling for spikes	Resize the box, hope	Handled by the platform
Where files live	On a disk you secure	Streamed — never on disk
Partner onboarding	OS users, chroot, keys	Add a user + public key
Delivery to your app	Cron polls the directory	Direct HTTPS POST on upload
Failure handling	Custom scripts	Retries + dead-letter queue
Audit / compliance	Parse logs yourself	Built-in audit log
Custom domain & SSO	You wire it up	Custom domain, SSO/SAML on Enterprise

When to use it (and the limits)

A serverless SFTP endpoint fits when partners mandate SFTP/FTPS but you have no appetite to own a file server: SaaS products onboarding enterprise customers, fintechs receiving bank files, retailers ingesting supplier feeds. Start on the Free tier (FTP, 100 transfers/month, no credit card) to prove the flow, move to Professional for SFTP, custom domain and transformations, and Enterprise for unlimited users, SSO/SAML and a dedicated IP.

The limits are worth stating plainly: this is an upload-driven model, so it shines for receiving files rather than serving a large browsable directory tree back to clients. SFTP requires the Professional plan or above. And sustained throughput is governed by your plan's monthly transfer and storage caps, so size the tier to your busiest partner.

Security and compliance posture

A serverless endpoint changes your security story in a meaningful way: the most common SFTP attack surface — a long-lived, internet-facing box with a writable filesystem and shell users — simply isn't there. There is no OS to harden, no chroot to get wrong, and no accumulating directory of sensitive files waiting to be exfiltrated, because uploads stream through rather than landing on disk. Authentication stays standard: SSH public keys for SFTP, TLS 1.2/1.3 for FTPS.

On the integrity side, every webhook delivery is HMAC-SHA256 signed so your endpoint can prove a payload came from FTPasHTTPS and was not tampered with in transit. Failed deliveries retry with exponential backoff and fall back to a dead-letter queue, and each transfer — success or failure — is recorded in an audit log. That log is what auditors and incident responders actually ask for: a per-file record of who connected, what they uploaded, and where it went. Enterprise adds SSO/SAML for your own team and a dedicated IP for partners that allowlist by address.

Frequently asked questions