MOVEit → xEvolve Migration Guide.

Why regulated teams are leaving MOVEit, and the six-step path to a cleaner regulated file-transfer platform.

Get the full migration whitepaper.

Drop your details and we'll send the full whitepaper — protocol mapping sheet, partner cutover checklist, and decommission attestation template.

Name Work email Company Email me the whitepaper

Why migrate.

• May 2023 — Cl0p mass exploitation (CVE-2023-34362). A SQL-injection zero-day in MOVEit's web transfer interface was exploited at scale by the Cl0p ransomware group.
• ~2,700 organisations compromised, ~93 million records exposed across US federal agencies, state governments, energy operators, healthcare payers, and professional services firms.
• Root cause: legacy ASP.NET monolith with direct SQL database access from request handlers — a class of vulnerability that recurs whenever a new endpoint is added.
• Five further critical CVEs patched by July 2023 (CVE-2023-35036, CVE-2023-36932, CVE-2023-36933, CVE-2023-36934, CVE-2023-36935), each disclosed and patched within the same campaign window.

Protocol parity.

xEvolve ships adapters for SFTP, FTPS, S3, Azure Blob, HTTP(S), WebDAV (AS2 is on the roadmap), and the long tail of legacy endpoints your partners still run. Existing flows map over without re-keying partner integrations or rebuilding automation scripts.

Where partners need a fixed endpoint, you publish one stable hostname — the protocol underneath can change without your partner noticing.

Automation parity.

MOVEit Automation Tasks, scripts, and parameters map directly to xEvolve Tasks, in-flight processing, and global parameters — you carry your automation logic over instead of re-platforming it.

• Tasks (source → process → destination)

  Multi-step transfer Tasks run end-to-end on demand, or on a schedule on Business and MSP, through one orchestrator — the same path for manual and cron runs.

• Resources → built-in scripts (find/replace, zip/unzip)

  In-flight processing transforms the transfer working folder in place — find/replace in file contents and names, plus zip and unzip — with no external script host.

• Resources → global parameters

  Reusable ${var} parameters resolve into Task paths and step configuration, shared across every Task in one place.

• Schedules and folder monitors

  Cron schedules and folder watchers (Business and MSP) trigger Tasks; condition steps branch on the prior step’s result and webhook steps post to downstream systems.

Migration in 6 steps.

1. 01

   Inventory your transfers and partners

   List every scheduled transfer, ad-hoc drop, partner endpoint, and credential. Most teams find 20–30% of flows are dormant — cut those before you migrate.

2. 02

   Provision an xEvolve Environment

   Spin up an Environment with its own schema in the shared EU Postgres database and shared R2 file storage. Your environment is scoped to your tenant from day one, each with its own audit trail.

3. 03

   Map protocols and wire SSO

   SFTP, FTPS, S3, Azure Blob, and HTTP(S) adapters replace your existing endpoints one-for-one. Operators sign in through Spot Suite single sign-on.

4. 04

   Parallel-run old and new

   Run MOVEit and xEvolve side-by-side for a full business cycle. Reconcile delivery receipts and audit logs before you touch a single production partner.

5. 05

   Cut partners over, one cohort at a time

   Move partners in waves — internal first, then low-volume external, then high-volume trading partners. Each cutover is reversible for 14 days.

6. 06

   Decommission MOVEit

   Export your final MOVEit audit trail for retention, revoke credentials, and stand the legacy instance down. We provide a decommission checklist and signed audit attestation.

What you gain.

• Published CVEs

  No published CVEs to date. Built on Cloudflare Workers with no legacy ASP.NET surface area and no direct SQL database access from request handlers.

• Tenant-scoped data

  One shared Worker, one schema per Environment in EU Postgres, one shared R2 file store. Audit trails and file payloads are scoped to your tenant.

• EU data residency

  The database, with file metadata and audit logs, is in the EU (Supabase, Paris). Files are in Cloudflare R2 in Western Europe, not locked to an EU jurisdiction. Backed by EU-only support. See the Trust page for how backups and recovery actually work.

• Activity log

  A per-transfer activity log in the dashboard, with audit export on request.

Ready to move?

Run a 30-day trial Environment alongside MOVEit. When you're ready, we help you cut over.