Take a Tour

x Close

Take a Tour

Meet Your SFTP Security Requirements

Since launching the world's first hosted FTP service in 2001, FTP Today has been heavily focused on file security and privacy. By the time regulations were due to go into effect on the health care industry, we already had it covered. Over the years, we have expanded our security focused offerings to include other industries such as financial, legal, military, defense and government.

While compliance is a shared responsibility, we partner with you by providing you compliance-ready software built on compliant cloud platforms, so you can confidently share files securely with your business partners.

 

One Software Company.
Two Private Clouds.

ftp-cloud

Built for business-to-business workflows and designed to share sensitive and private data with the highest levels of commercial-grade security, meeting most compliance requirements such as HIPAA, GDPR, PCI-DSS, GLBA and SOX.

GOVFTPCloud (dab36842-a525-41ca-9587-3a6d019a8b67)

Built for government agencies, their contractors and sub-contractors to share sensitive data with the most stringent U.S. Government security and compliance requirements such as ITAR, DFARS, FedRAMP Moderate and DoD IL2 workloads.

Compare our two cloud platforms:
ftp

PLATFORM COMPLIANCE

Partner: Flexential
Production Data Center Location: Louisville, Kentucky
DR Data Center Location: N/A (no DR on standby)
Flexential Enterprise Cloud Compliance:

  • SSAE-18 (Type 2) SOC1, SOC2, SOC3
  • ISO 27001 Certified
  • PCI-DSS Certified
  • HIPAA / HITECH Ready
  • EU-US PRIVACY SHIELD Certified
govftp

PLATFORM COMPLIANCE

Partner: DataBank
Production Data Center Location: Plano, Texas
DR Data Center Location: Baltimore, Maryland
DataBank FedRAMP Cloud Compliance:

  • SSAE-18 SOC1, SOC3, SOC3 (Type 2)
  • ISO 27001 Certified
  • PCI-DSS Certified
  • HIPAA / HITECH Ready
  • EU-US PRIVACY SHIELD Certified
  • FedRAMP P-ATO
  • FISMA / FedRAMP Moderate
  • NIST SP 800-53
  • NIST SP 800-171 / DFARS
  • DFARS 252.204-7012
  • DoD Impact Level 2 P-ATO
  • ITAR / EAR
  • CJIS

Managed Services

How do you inherit the above compliance? It is the combined managed services provided by FTP Today and its infrastructure partners that you inherit to achieve your compliance requirements. These managed services fall into three service tiers:

  1. Infrastructure-as-a-Service (IaaS) - Includes Internet bandwidth, the physical data center, network firewalls, host hardware, storage systems, and the hypervisor that delivers cloud servers (virtual machines).
  2. Platform-as-a-Service (PaaS) - Includes the virtual machine, OS management and patching, storage encryption, backup and contingency planning. 
  3. Software-as-a-Service (SaaS) - Includes the applications designed, managed and provided by FTP Today that make up the subscription service.

Let's examine these managed services in more detail:
ftp

OUR RESPONSIBILITY

IaaS by Flexential:

  • 1 Gbps Internet connection
  • Dedicated Firewalls for THE FTP CLOUD™
  • IT Infrastructure and Network Monitoring
  • High Availability VMWare Cloud
  • Remote Access Security (VPN)
    for FTP Today Privileged Staff

PaaS by FTP Today:

  • Vulnerability Scanning and Remediation
  • Continuous Monitoring Program
  • Managed OS
  • Storage Encryption
    • Folder-level (AES-128)
  • Offsite Backup
    • Encrypted in Transit (AES-256)
    • Encrypted at Rest (AES-256)
    • Incremental Backups: Daily
    • Backup Retention: 7 days
  • Contingency planning
    • Service RTO: Best Efforts (min. 48 hours)
      • Re-build in another Flexential location.
      • Re-broadcast IP addresses to new location.
    • Data RTO: Best Efforts (min. 48 hours AFTER Service RTO)
    • RPO: Best Efforts

SaaS by FTP Today:

govftp

OUR RESPONSIBILITY

IaaS by DataBank:

  • 1 Gbps Internet connection
  • Dedicated Firewalls for THE GOVFTP CLOUD™
    • Network Intrusion Detection
  • IT Infrastructure and Network Monitoring
  • High Availability VMWare Cloud
  • Remote Access Security (VPN)
    for FTP Today Privileged Staff
    • MFA w/ token required

PaaS by DataBank:

  • Host-based Intrusion Detection
  • Vulnerability Scanning and Remediation
  • Continuous Monitoring Program
  • Managed OS
    • Hardened to Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) benchmarks
  • Storage Encryption
    • SAN-based (AES-256)
  • Onsite Backup
    • Encrypted in Transit (AES-256)
    • Encrypted at Rest (AES-256)
    • Incremental Backups: Daily
    • Onsite Retention: 30 days
  • Contingency planning
    • Standby infrastructure
    • Replicated daily
    • RTO: 24 hours
    • RPO: 24 hours
  • Formal Change Control Tools and Process
  • Ongoing FISMA / FedRAMP / DFARS Monitoring and Administration
  • Formal Configuration Management per FedRAMP SSP
  • NIST SP 800-53 Control-Specific Management Services, including NIST SP 800-171
  • Log Consolidation & Analysis
  • Advanced Malware Protection
  • Session Recording
  • Real-time Performance Monitoring
  • File Integrity Monitoring Service

SaaS by FTP Today:

The rest is up to you. But, we make it easy!

Compliance is a shared responsibility. The above platform compliance and managed services are our responsibility, which provides the foundation for your compliance requirements. It is now up to you to utilize our software to fully enforce your file sharing compliance. Our software is very user-friendly and it includes many administrative tools for you to ensure that:

  1. Your transmissions are secured end to end,
  2. Your users are forced to comply with everything from password strength to encrypting transmissions,
  3. Your folders are secured so that only the appropriate users have access with the appropriate permissions, and
  4. Your auditors can verify everything.

The following is a summary of the controls we place in your hands:
ftp

YOUR RESPONSIBILITY

Administrative Controls:

  • Activate / Deactivate Protocols
    • Choose from FTP, FTPeS, FTPS, SFTP & HTTPS
    • In-transit Encryption is Enforced by Disabling FTP
  • Restrict Logical Access by Country (Geo-IP)
  • Manage Users & Credentials
    • Enforce Password Strength & Expiration
    • Allow or Require SSH-key Authentication (SFTP)
    • Suspend or Auto-Suspend Inactive Users
    • Require Multi-Factor Authentication per User
      • OTP & TOTP
    • Restrict User Access by IP Address
    • Restrict User Access by Protocol
  • Manage Folders
    • Assign User Access
    • Restrict Permissions per User
      • Upload, Download, Delete, List
    • Manage File Retention Controls
  • Manage Activity-triggered Email Notifications
  • View & Export Activity Reports
  • View & Export Detailed Logs
govftp

YOUR RESPONSIBILITY

Administrative Controls:

  • Activate / Deactivate Protocols
    • Choose from FTP, FTPeS, FTPS, SFTP & HTTPS
    • In-transit Encryption is Enforced by Default*
      *FTP can be enabled by exception if customer needs to mix compliant and non-compliant workloads on their GOVFTP site.
  • Restrict Logical Access by Country (Geo-IP)
  • Manage Users & Credentials
    • Enforce Password Strength & Expiration
    • Allow or Require SSH-key Authentication (SFTP)
    • Suspend or Auto-Suspend Inactive Users
    • Require Multi-Factor Authentication per User
      • OTP & TOTP
    • Restrict User Access by IP Address
    • Restrict User Access by Protocol
  • Manage Folders
    • Assign User Access
    • Restrict Permissions per User
      • Upload, Download, Delete, List
    • Manage File Retention Controls
  • Manage Activity-triggered Email Notifications
  • View & Export Activity Reports
  • View & Export Detailed Logs

5 Essentials to Choose the Best FTP Hosting Service for Your Business Needs

Businesses who rely on the productivity, flexibility, compatibility and security from a file sharing software - rely on FTP Today.