What is SFTP?
Secure File Transfer Protocol (SFTP) is a secure method for transferring files over the internet. It is a popular product for businesses needing to keep their data secure, for example, legal organisations, financial services companies, and payroll data companies.
The process works by using an SFTP server to securely upload, store and retrieve files. Users access the server through an interface which can be customised to meet individual business needs. SFTP uses the Transmission Control Protocol (TCP) method of data transfer, which establishes a connection between the user and the server.
Using firewalls, authentication and encryption with an SFTP solution brings security advantages over other methods such as File Transfer Protocol (FTP), which stores data in plain text.
Regulations and legislation around data transfer and storage
Security around data transfer and storage is a crucial consideration for every business, with a wide range of regulations and legislations surrounding the topic.
Every country will have regulations and legislation around data transfer and storage. There are several key policies to consider, but it is important to fully research and seek advice on the rules wherever you plan to operate, and ensure your file transfer method is compliant.
General Data Protection Regulation (GDPR)
The GDPR was implemented by the European Union (EU), and imposes obligations onto organisations in any country that collect personal data related to people in the EU. The key aim of GDPR is to protect the personal data of individuals, and requires you to consider how you protect your customer’s data at every stage of your business.
Data Protection Act (DPA)
The DPA is the UK’s implementation of the GDPR. It requires UK companies to provide adequate protection to all customer data they collect and store. This includes not transferring data outside of the European Economic Area (EEA) without adequate protection.
U.S. regulations
Regulations across the U.S. vary by state, but include several nationwide acts. The Privacy Act requires U.S. agencies to comply with statutory norms for collection, maintenance, access, use and dissemination of records. The CLOUD Act was enacted in the U.S. with the aim of providing timely access to electronic evidence.
Sector specific regulations
Additionally certain sectors will have their own regulatory bodies, such as the Financial Conduct Authority for the finance sector in the UK, or the Health Insurance Portability and Accountability Act (HIPAA) for healthcare in the U.S.
Consequences of a data breach
Breaching data regulations can have significant consequences for a business. Companies that breach the DPA risk facing fines of up to £500,000 depending on the severity of the breach. Companies that breach GDPR can be fined up to 20,000,000 EUR or 4% of their worldwide annual turnover for the preceding year if this is higher. While these are the ‘worst-case-scenario’ figures, it is not worth risking the potential financial consequences.
In addition to the fines, data breaches are damaging to a business’s reputation. Potential customers are not likely to be willing to work with a company they cannot trust to keep their information safe. This lack of consumer trust in a business can lead to financial consequences for years afterwards and, in some cases, can cause a business to shut down.
How can SFTP support compliance?
The security processes in place with SFTP assists your business in complying with all relevant regulations and legislation.
SFTP utilises encryption to protect your data. Data is only transferred in an unreadable format so it cannot be compromised, supporting your compliance with data protection regulations. Additional protection measures include restricting access to the SFTP system and files to verified users only, and multi-factor authentication using an authenticator app to verify the identity of users.
SFTP provides a much more secure connection and error handling than FTP. Using encryption and tunnelling through one channel as opposed to two means that the connection is always secured, and no clear data, such as text passwords, is transferred.
How can SFTP support data sovereignty?
Data sovereignty refers to data being subject to the laws of the country in which it is stored. Transferring and storing data across multiple jurisdictions can lead to compliance issues if regulations are not taken into account.
For example, while US data laws permit government access to data under certain circumstances, UK data protection laws, under the Data Protection Act 2018 and GDPR, require that data be secured and accessed only under legally justified conditions. Proper safeguards and legal mechanisms must be in place to ensure compliance with UK standards when data is hosted outside the UK.
It is also important to be aware of where data is stored when using online file transfer services. The DPA specifically states that data must not be transferred outside of the EEA without adequate protection. This means UK companies storing data on servers based in the US could risk breaching the DPA and GDPR unless adequate safeguards are in place to ensure that the data is protected to the same standards as required by UK law.
Working with a reputable provider to implement an SFTP solution can resolve your data sovereignty concerns. Your provider will be able to advise on specific regulations and how they impact you, ensuring your solution is fully compliant.
Why use Hyve for your SFTP solutions?
Our SFTP service provides users with a fully managed, secure platform to securely send, receive and store valuable company data. All data uploaded is stored in our highly secure data centres around the globe, with every customer’s SFTP solution run on their own dedicated server. This ensures there are no issues with noisy neighbours or cross-user security which can occur with SaaS-based solutions using shared resources.
We provide 24/7/365 support to our customers, with industry-leading SLAs for response times. If any problems arise with your SFTP, our team responds to critical issues in under 20 minutes.
With SFTP solutions from Hyve, you can rest assured that your data is secure, encrypted, and compliant with the relevant regulations in your area(s) of operation. To find out more, visit our dedicated SFTP page, or fill out our contact form and one of our experts will be in touch.
