1-855-888-4387 (Toll Free) 1-416-532-4387 (Intl)

Hosted~FTP~ Security Model Overview

Our cloud-based FTP services are designed to have a high degree of security for logging into the account, administering and configuring privileges and providing audit logs of all transfers. The diagram below provides an overview of the security model which can be downloaded at this link.

Security Model overview

Personally Identifiable Information (PII)

Personally identifiable information (PII), or Sensitive Personal Information (SPI), as used in US privacy law and information security, is information that can be used on its own or with other information to identify, contact, or locate a single person, or to identify an individual in context.

Hosted~FTP~ data location

When you subscribe to the Hosted~FTP~ services all data will then reside in the US at Amazon Web Services West Virginia location.

Secure data transfer

The Hosted~FTP~ SaaS application has been designed to ensure that all PII information, including data, login credentials, and file-names/folder-names, can be transmitted securely and stored in the Amazon Web Services securely. Hosted~FTP~ provides for data to be 256 bit AES encrypted in transit, on arrival and at rest:

In transit

For transfers by web browsers:

-our website is secured by HTTPS with AES 256 bit encryption (certified by the US government for top secret information)

For transfers by FTP (i.e. FTP client programs, scripts, etc.)

-we support FTPS (FTP over TLS/SSL) with AES 256 bit encryption and  SFTP (see this link for a further description of the FTPS and SFTP protocols) with PKI or username/password authentication

On Arrival

Hosted~FTP~ encrypts the data as soon as it arrives at the Hosted~FTP~ Amazon cloud location and before any processing takes place to ensure that the data is never unprotected. This includes all data, credentials and file-names and folder names; a process that is unique to Hosted~FTP~.

At rest

The encrypted files are then securely uploaded by HTTPS to Amazon S3 cloud storage, where Amazon encrypts the files a second time before they are stored.

Server Port lock-down & File integrity

Port lock-down

All Hosted~FTP~ servers are locked down completely except for the ports required to serve HTTP, HTTPS, FTP, and FTPS

File Integrity (chain of custody)

All files are fingerprinted with an MD5 hash that is stored with reference to the file. When the file(data) is retrieved the MD5 hash is recreated and compared against the original to establish proof that there has been no tampering.

Privacy and Intrusion protection

Login protection & lockout

All Hosted~FTP~ accounts are only accessible by username and password; the account administrator grants sharing and login privileges to the users, contacts, folders, and files in the account.  After 3 unsuccessful login attempts the account username is frozen for 10 minutes before the next login cycle is enabled

Application/program execution on the Hosted~FTP~ site not allowed

Hosted~FTP~ does not allow any user programs to execute at all; our clients can only use our service to upload, retrieve and provide email notifications by our secure email server.

Multi-factor authentication

Multi-Factor Authentication (MFA) is a simple best practice that adds an extra layer of protection on top of your username and password. With MFA enabled, when a user signs in to a Hosted~FTP~ account, they will be prompted for their username and password (the first factor); then they will be prompted for an authentication code from their MFA device (the second-factor – what they have). We have implemented the Google Authenticator app; it’s available on Android devices, iOS devices like the iPhone, BlackBerry devices, and Windows Phone via 3rd party apps.

Audit Trail of all Logins and File transfer activity

We provide logs of all user login activity and also upload/download activity for purposes of audit and tracking in each user account in the form of daily Excel and/or .CSV files stored in each admin account.

Backup and recovery

We are 100% cloud, meaning that all of our infrastructures is hosted in the Amazon Cloud. Amazon S3 provides a highly durable storage infrastructure designed for mission-critical and primary data storage. ” see this link for further details.

Amazon has many processes and certifications to guarantee the safety and reliability of the files stored in S3. We adhere to all Amazon’s security best practices. Amazon redundantly stores files on multiple devices across multiple facilities in an Amazon S3 Region before we provide a SUCCESS to the user.

File & user deletion policies

  • File/folder deletion: when a contact or user with Read/Write privileges deletes a file/folder it is permanently deleted from the Hosted~FTP~ AWS S3 storage and all links to the database are permanently severed. No files can be recovered under any circumstances
  • User/Username deletion: when a User/Username is deleted the Files tab workspace and all files owned by the user are permanently deleted, all shared folders and the user is removed from the Users tab. Note that the user is still on the Contacts tab.

Hosted~FTP~ maintenance and AWS SLA standards

Hosted~FTP inherits the AWS infrastructure SLA with a commitment as noted below. Please see the links for further info.:

“AWS will use commercially reasonable efforts to make Amazon S3, EC2 and Amazon EBS each available with a Monthly Up-time Percentage (defined below) of at least (see below) in each case during any monthly billing cycle (Service Commitment)
http://aws.amazon.com/ec2/sla/   SLA is 99.95 %
http://aws.amazon.com/s3/sla/   SLA is 99.9%

Hosted~FTP~ has a reserved maintenance window on Saturday from 10 am to 12 PM.  The scheduled maintenance releases are typically infrequent and of short duration. Hosted~FTP~ will make every reasonable effort to make the overall service available with an SLA of 99.95 %.

AWS Component SLA standards

Amazon S3 is designed for 99.99% availability and 99.999999999% durability (see this link)
Amazon EBS volume data is replicated across multiple servers in an Availability Zone to prevent the loss of data from the failure of any single component. HFTP configures multi-availability zones for transparent recovery from any failures. (see this link)
Amazon RDS Multi-AZ deployments provide enhanced availability and durability for Database (DB) Instances, as configured by HostedFTP (HFTP)
Amazon EC2 Service Level Agreement commitment is 99.95% availability for each Amazon EC2 Region. (see this link)
Reference links
http://aws.amazon.com/security/
http://aws.amazon.com/s3/
http://aws.amazon.com/ec2/
http://aws.amazon.com/rds/
Amazon Web Services compliance & security standards
The AWS infrastructure is HIPAA compliant. The AWS cloud infrastructure has been designed and managed in alignment with regulations, standards, and best-practices. Please review the following links
AWS Compliance
AWS Security
HIPAA
SOC 1/SSAE 16/ISAE 3402 (formerly SAS70)
SOC 2
SOC 3
PCI DSS Level 1
ISO 27001

Getting Started
Signing up for a Free Trial
Basic steps to Setup
Purchasing your account
Choosing the right account type: Enterprise and SMB
Logging into your account
Logging in with a Web Browser
Logging in with an FTP/FTPS/SFTP Client
Logging in by FTP URL with Username and Password
Reset and change your password
Administrator Initial Setup
Audit logs for logins and file transfers
Enable audit logs for login and file transfers
Accessing and viewing your audit logs
Branding
Adding branding to your account
Branding Contact Logins
DNS Configuration for faster transfer speeds
Web Interface
Home Tab
Files Tab
Contacts Tab
Users Tab
Plugin Tab
Setup Tab
Adding a User or Contact
Adding a Contact by Email Address
Add a User by Email Address
Add a User by Username
Using Groups
Administrator Access to User Accounts
Mail
Creating A Public Link
Sending and receiving files by secure email link
Creating contact lists for bulk emailing
HostedFTP email notification IP addresses
Account setup PDF Guides (*.pdf)
Shared Folders
Restricted Shared Folders
Configuring for Restricted Shared Folders (FUSN)
Creating Restricted Shared Folders
Creating Folder Structures for Sharing
Detailed Steps to Sharing Files/Folders
Managing Shared Folder Privileges
Add real-time notifications to uploads/downloads
Anonymous Access
Creating A Public Link
Anonymously Sharing Files by URL
Sharing folders and files anonymously
Transferring Files
Uploading Files by Web Browser (Max 2GB)
Uploading Files by FTP Client (Up to Max File Size)
Download your FTP/SFTP server files from any browser
Download files with an FTP client
Website Plugin
Web Plugin Overview and Guide
Plugin Brand Customization
Embed the Plugin into Your Website
Adding Additional Security (CAPTCHA, Password)
Security and Compliance Info
Security Model Overview
Security Model Details
MFA (Multi-Factor Authentication)
Certificate & Host Key Info
SSL Certificate Info
SSL Server Test
FTPS Host Keys
SFTP (RSA/DSA) Host Keys
Configuring PKI Support
Compliance Info
GDPR
WCAG 2.0
SOC2
CJIS
PCI
HIPAA
Bundle Features
Group, Enterprise, T2, T5 bundle features
Different user types and function comparisons
Difference between users and contacts
Drag & Drop
Using drag and drop to send multiple files and folders
Drag and drop to upload multiple files and folders
Account Management
Purchasing your account
Payments & Billing
Choosing a payment plan
Renewing an expired account
Changing a Payment Plan
Changing credit card information
Reviewing billing statements
Trial Account Limits
Activated Account Limits
How is Storage Calculated?
Reviewing Account Storage Usage
Switching Account Bundles
Changing the Account Administrator
Cancelling an Account
FTP/FTPS/SFTP Connections
Hosted~FTP~ IP Addresses
Connect with Open FTP
Connect with Secure FTPS/SFTP
Connecting with an FTP Client
FTP vs FTPS vs SFTP
Command Line (CLI)
How to connect to your remote site using the command line
Understanding FTP commands in the command line
Connecting through SFTP by Command Line (CMD)
FTP/FTPeS command line error codes and their meaning
Windows Explorer
How to setup an FTP server with Windows Explorer
Setting up Windows Explorer FTP on Windows 8
MAC
Connecting from a Mac Computer Terminal
FileZilla
Using Filezilla with FTP/FTPS
Using FileZilla with SFTP
WebDrive
Connecting to WebDrive
Using WebDrive
WinSCP
Installing WinSCP
Backup Scripts with WinSCP
Uploading & Downloading with WinSCP
AndFTP
Uploading & Downloading with AndFTP
Searching, Resume Support & Third-party Sharing with AndFTP
Industry Use cases
Accounting
Architecture
Call Center
Construction
Education
Engineering
Finance
Healthcare
Insurance
Legal
Real Estate
Manufacturing
Best Practices
User Optimization
Create a Managed User
Giving a User Read-only Access
Giving a User Full Access
Default FTP Folder Destination
Set a 0GB Storage Quota
Importing Multiple Users & Shared Folders
Importing user and shared folders
Import templates for users and shared folders
Force Secure FTPS/SFTP Connection on Users
Combine multiple audit logs
Managing FTP Files and Storage in your Account
Moving Files from a User to an Administrator
Video Tutorials
QuickStart
FUSN
Branding
Web Interface
Home Tab
Files Tab
Web Plugin
AndFTP
AndFTP – Connecting, uploading and downloading
AndFTP – Searching, resume support and third-party sharing
WinSCP
WinSCP – Downloading, Installing and Understanding
WinSCP – Connecting with FTP, FTPS, SFTP, uploading and downloading
WinSCP Backup Script
CyberDuck
Cyberduck– Connecting with FTP,FTPS, SFTP, Uploading and Downloading
Cyberduck– Quick Look, Transfer Queue and Synchronizing
Cyberduck – Bookmarks, Editing and using Multiple Connections
FileZilla
FileZilla -Downloading, Installing and Understanding FileZilla
FileZilla – Connecting with FTP, FTPS, SFTP and uploading and downloading
FileZilla – Importing/Exporting Site Connections, Editing and Logs
FileZilla Tools – Bookmarking, Searching, using Multiple Connections
Our FTP Client Reviews
Desktop FTP Client Summary
Mobile FTP Client Summary
PSFTP Review : Our Rating 7.5/10
NetDrive Review: Our Rating 8.5/10
FireFTP Review : Our Rating 7/10
Filezilla Review: Our Rating 9/10
AndFTP Review:Our Rating 7.8/10
ES File Manager Review: Our Rating 5/10
FTP Ready Review:Our Rating 5/10
FTP On The Go Review:Our Rating 8/10
CyberDuck Review: Our Rating 9/10
Classic FTP Review: Our Rating 8/10
WebDrive Review: Our Rating 9.5/10
Fling FTP Review: Our Rating 9/10
SmartFTP Review: Our Rating 7/10
MultCloud Review: Our Rating 10/10
Troubleshooting
Error: QUOTA_USER_STORAGE or QUOTA_USER_BANDWIDTH
FTP/FTPeS command line error codes and their meaning
Troubleshooting FTP in the command line and common errors.
No matching host key found
Storage Quota Notification: Remedial action
Troubleshooting FTP in the command line and common errors.
Troubleshooting "Can't verify publisher"
Troubleshooting Drag and Drop
Drag and Drop Troubleshooting for Mac
Troubleshooting FTP/SFTP client connection problems
Troubleshooting slow upload speeds on Windows
No matching host key found
File not visible to admin
File uploaded successfully but not visible in account
Usernames – Guidelines and Restrictions
Release Notes
New Release Communique
Schedule Maintenance Overview
Contact Sales & Support
Bitnami