# SFTP

> SFTP (SSH File Transfer Protocol) transfers files securely over a Secure Shell (SSH) connection; despite the name, it is a separate protocol from the older FTP.

Original page: https://t10.de/en/glossary/sftp
Publisher: total10 GmbH, https://t10.de/en/glossary

SFTP runs on Secure Shell (SSH). RFC 4251, a technical specification from the Internet Engineering Task Force (IETF), describes SSH as a protocol for logging in to remote computers and using other network services securely across an insecure network. An IETF draft published in October 2001 says SFTP provides secure file transfer over any reliable data stream and calls it the standard file transfer protocol for version 2 of SSH.

SFTP itself has not been published as an RFC: the [IETF draft series](https://datatracker.ietf.org/doc/draft-ietf-secsh-filexfer/) stopped at revision 13 in July 2006 and has since expired. The older FTP was set out in RFC 959 in October 1985. As RFC 2228 points out, FTP in that original form made no provision for encrypting commands, replies or transferred data, and it sent usernames and passwords in plain text. FTP over TLS (Transport Layer Security), described in RFC 4217, adds security and authentication to FTP by another route; it is not SFTP either.

For our own software, SFTP is the second standard way of connecting to existing systems, alongside APIs. In a proof-of-delivery project for a pharmaceutical logistics company, for example, our software collects proofs of delivery and order data over SFTP and, for one client, sends the proofs straight to that client's own server. The existing warehouse management system stays as it is.

## See also

- [API](https://t10.de/en/glossary/api): An API (application programming interface) is a defined set of functions and rules that lets one piece of software use the features or data of another system or service.
- [Interface](https://t10.de/en/glossary/interface): An interface is the point at which two systems, programs or components meet and exchange data; the word also covers the user interface between a person and software.
- [Business application](https://t10.de/en/glossary/business-application): In general terms, a business application is software used to perform or support business functions.
- [WMS](https://t10.de/en/glossary/wms): WMS stands for warehouse management system; according to the short description of VDI 3601, its task is to manage and optimise a company's internal storage and transport systems.

## Where the term appears

- [Proof of delivery in pharma logistics: a case study](https://t10.de/en/blog/pod-handling-pharma-logistics)
- [Stock alerts in pharma logistics, without a web shop](https://t10.de/en/blog/stock-alerts-pharma)
- [Pharma IT services: Non-GxP software](https://t10.de/en/pharma)
- [Bespoke software & business apps with Symfony](https://t10.de/en/symfony-development)

## Sources

1. [draft-ietf-secsh-filexfer-02: SSH File Transfer Protocol (Internet-Draft, Oktober 2001)](https://datatracker.ietf.org/doc/html/draft-ietf-secsh-filexfer-02), IETF, Secure Shell Working Group (secsh), accessed 2026-11-07
2. [RFC 4251: The Secure Shell (SSH) Protocol Architecture (Januar 2006, Standards Track)](https://www.rfc-editor.org/rfc/rfc4251.txt), IETF (RFC Editor), accessed 2026-11-07
3. [draft-ietf-secsh-filexfer-13: SSH File Transfer Protocol (Status-Seite)](https://datatracker.ietf.org/doc/draft-ietf-secsh-filexfer/), IETF Datatracker, accessed 2026-11-07
4. [RFC 959: File Transfer Protocol (FTP) (Oktober 1985)](https://www.rfc-editor.org/rfc/rfc959.txt), IETF (RFC Editor), accessed 2026-11-07
5. [RFC 2228: FTP Security Extensions (Oktober 1997, Standards Track)](https://www.rfc-editor.org/rfc/rfc2228.txt), IETF (RFC Editor), accessed 2026-11-07
6. [RFC 4217: Securing FTP with TLS (Oktober 2005, Standards Track)](https://www.rfc-editor.org/rfc/rfc4217.txt), IETF (RFC Editor), accessed 2026-11-07