Doing business file transfers without leaking them

Encryption in transit is the easy part. Most real incidents come from a shared password, a drop folder nobody cleaned out, or a transfer that silently truncated. These habits close those gaps.

Authenticate with keys, not shared passwords

Give every partner and every automated job its own key and its own account. When a contract ends you delete one key instead of rotating a password that six systems use.

Verify the host, every time

Record the server fingerprint in your runbook. An automated job that blindly accepts any host key will happily upload your data to a machine that answered on the right address.

Prove the file arrived intact

Get-FileHash .\export.zip -Algorithm SHA256

Compare with the value computed on the far side. For nightly jobs, transfer a .sha256 file alongside the payload and have the receiver check it before processing.

Manage the landing folder

Pin each account to its own filesystem root.
Move processed files out of the drop folder on a schedule.
Set a retention window and enforce it with a scheduled task.
Keep transfer logs long enough to answer an audit question.

Questions people ask about this

Is SFTP acceptable for regulated data?

The protocol is generally accepted, but compliance depends on your controls: authentication, access scoping, logging and retention. Confirm requirements with whoever owns the policy.

Should we still run FTP for one old partner?

Prefer an FTP-to-SFTP bridge on your side over exposing plain FTP to the internet.

Independent guide. Software names belong to their respective developers; always download from the vendor's own site. Back to all Windows SSH guides.