Encrypted file transfer protects data while it moves between systems. Common options include SFTP over SSH, FTPS using TLS, HTTPS upload or download portals, and managed file-transfer services. File-level encryption can add protection before and after transport.
Encryption alone does not prove that the recipient is correct or that an account is authorized. Safe transfer also requires server authentication, access control, integrity, key management, logging, and deletion rules.
SFTP vs. FTPS vs. HTTPS
| Method | Protection | Operational notes |
|---|---|---|
| SFTP | Runs as a file-transfer protocol over SSH | Usually one connection; verify the server host key |
| FTPS | Extends FTP with TLS | Uses separate control and data connections; firewall setup can be complex |
| HTTPS | Transfers through HTTP over TLS | Well suited to browsers, APIs, and expiring download links |
| File-level encryption | Encrypts the file itself | Can protect stored copies; keys must travel separately |
SFTP is not “FTP over SSH,” and FTPS is not SFTP. The names are similar but the protocols and configuration differ.
Encryption in transit vs. at rest
Transport encryption protects the connection while data moves. It does not automatically protect temporary files, server storage, backups, email notifications, or a recipient’s downloaded copy. Encrypt sensitive files at rest when required and define when staging and shared copies are deleted.
Verify the server and recipient
For SFTP, verify the SSH host-key fingerprint through a trusted channel before accepting it; blindly accepting a changed key can enable interception. For FTPS and HTTPS, validate the hostname, certificate chain, and expiration. Do not disable certificate or host-key checks to make an automation job succeed.
Confirm the recipient and destination independently, especially after an email request to change account, hostname, or key.
Authentication and key management
Prefer unique service identities and narrowly scoped keys over shared passwords. Protect private keys with appropriate file permissions and a secret manager, rotate them, and revoke them when a user or integration is retired. MFA is valuable for interactive portals, while automated transfers need managed non-human identities and monitoring.
How to send encrypted files safely
- Classify the file and confirm transfer is permitted.
- Use an approved protocol with current TLS or SSH configuration.
- Verify the server, recipient, and destination path.
- Grant access only to the required file and expiration period.
- Scan incoming and outgoing files where policy requires it.
- Record a cryptographic hash or signed manifest when integrity must be verified.
- Confirm receipt before deleting the source, then apply retention rules.
If file-level encryption is used, send the decryption password or key through a separate trusted channel—not in the same email or chat as the file. Confirm the recipient before disclosing it, and use a unique secret rather than reusing an account password.
Sharing links and expiration
An HTTPS link should use a strong, unguessable token, a short expiration, and the minimum required downloads. For sensitive data, require recipient authentication instead of treating possession of the link as permanent access. Avoid placing reusable secrets in URLs because browsers, proxies, and logs may retain them.
Common mistakes
- Using plain FTP or HTTP on an untrusted network.
- Emailing the decryption key with the encrypted attachment.
- Disabling certificate validation or ignoring a changed SSH host key.
- Sharing one account across people and integrations.
- Leaving uploaded files and public links active indefinitely.
- Assuming encryption prevents a compromised endpoint from reading the file.
When a transfer credential is exposed
Revoke the password, token, or key; review access and download logs; identify affected files; and notify the data owner. Replace credentials in automation through the approved secret store, not source code. If sensitive data may have been accessed, follow the organization’s incident, privacy, and legal procedures.