Architecture
5 questions, deterministic verdictFile transfer protocol picker
Five questions about your workload, one recommendation. Covers SFTP, AS2, HTTPS API, and FTPS, with a comparison matrix below if you want to see all the trade-offs at once.
Question 1 of 5
Protocol comparison
| Protocol | Use case | Auth | Receipts | NAT-friendly | xevolve |
|---|---|---|---|---|---|
| SFTP | General-purpose file movement, partner exchange, batch jobs | SSH keys, password, MFA at gateway | Logged transfer events, no cryptographic receipt | Yes, single port (22) | Supported |
| AS2 | Regulated B2B and EDI (retail, healthcare claims) | X.509 certificates, S/MIME signing | Signed MDN receipts (non-repudiation) | Yes, runs over HTTPS | Not supported by design 1 |
| FTPS | Legacy partner mandates, mostly being retired | TLS client cert or password | No | Painful, dynamic data-channel ports | Not supported by design 1 |
| FTP | None. Plaintext protocol from 1985 | Plaintext password | No | Painful, plus everything is in the clear | Not supported |
| HTTPS API | System-to-system, real-time, event-driven | OAuth, API keys, mTLS | HTTP status, optional webhook callbacks | Yes, runs over 443 | Supported |
| AS4 | EU regulated B2B (PEPPOL, energy sector) | X.509 certificates, WS-Security | Signed receipts (ebMS 3.0) | Yes, runs over HTTPS | Not supported |
1 xevolve runs SFTP and HTTPS only. If a counterparty mandates AS2 or FTPS, we will help you negotiate them onto SFTP, or pair with a partner gateway. The matrix shows the protocol on its own merits, not the xevolve roadmap.
FAQ
Is SFTP always the right answer?
For most cases, yes. SFTP runs over a single TCP port, supports modern key-based auth, works through firewalls without drama, and every counterparty already speaks it. It is the wrong choice when a regulated EDI partner mandates AS2 with signed receipts, or when two systems you control could just call each other over HTTPS.
Why does xevolve not support AS2 or FTPS?
AS2 carries a heavy spec (S/MIME, MDNs, certificate management) that mostly serves a shrinking set of EDI partners. FTPS uses dynamic data-channel ports that fight every modern firewall. Building both well takes engineering attention we would rather spend on SFTP, HTTPS, and the storage targets people actually use. If a counterparty mandates AS2 or FTPS, we will help you negotiate them onto SFTP, or pair you with a partner gateway.
Should I migrate a long-running FTPS partner to SFTP?
If you have the leverage, yes. FTPS pain shows up later (passive-mode port ranges, NAT traversal, certificate trust chains across two channels, opaque failures during firewall changes). SFTP has one port and one auth model. The migration is usually a key exchange and a path swap, finished in an afternoon per partner.
What about MFT vendors that bundle every protocol?
They exist and they work, at a price. Bundling AS2, FTPS, OFTP, AS4, and HTTPS into one product means the per-seat or per-connection cost reflects all of it, even if you only use SFTP. If your real protocol mix is SFTP plus HTTPS, paying for the full bundle is overspend. If you genuinely need AS2 for EDI, a focused gateway in front of an SFTP-first MFT is usually cheaper than the all-in-one.
Related free tools
More from the xevolve tools shelf, no signup required.
SFTP to S3 cost calculator
AWS Transfer Family + S3 + egress cost vs flat-fee MFT.
MFT 3-year TCO calculator
Build your own SFTP, buy a vendor, or run xEvolve. Compare.
MFT compliance framework map
Pick the frameworks you need and see which controls satisfy each.
SFTP / SSH key strength checker
Paste a key, get the algorithm, length, and a NIST verdict.
Running SFTP or HTTPS at partner scale?
xevolve handles SFTP and HTTPS file transfer with per-partner keys, IP allowlists, audit trails, and EU residency. TLS 1.3 in transit, AES-256-GCM at rest, MFA via TOTP, WebAuthn, or SSO. Architected for SOC 2 Type 2 readiness.
Talk to xevolve