External SFTP Servers
An external SFTP server is an SFTP server outside tiCrypt that a Super-admin registers so that specific users and teams can push files from their Vault to it. Users reach it through SFTP bidirectional, under My Computer in the Vault. An entry holds the server's name, host, port, an optional expiration date and an allowlist of users and teams. It holds no credentials: each user signs in with their own account on the server.
An external SFTP server is not an SFTP inbox endpoint. The SFTP inbox endpoint in System Settings is tiCrypt's own SFTP service, which receives files from people without a tiCrypt account. An external SFTP server belongs to someone else and is a destination for data leaving tiCrypt.
Why external SFTP servers are allowlisted
SFTP bidirectional is the one kind of SFTP connection that can send Vault files to a server outside tiCrypt, where they arrive decrypted. Users cannot type an address for it. They choose from the servers registered here, and each time a user connects, tiCrypt Connect asks the backend to confirm that the user, or one of their teams, is on that server's allowlist. The backend refuses the connection otherwise and logs every check. The push itself runs as a download through tiCrypt Connect, so project download rules and download records apply as they do for any download.
Treat each entry as an export authorization rather than a connection setting, and register only destinations your institution has approved to receive the data in question.
SFTP inbound needs no entry here. It only brings data into the Vault, so users can connect it to any server their computer can reach. See SFTP Connections.
What an entry controls
The following table describes the fields of an external SFTP server.
| Field | Effect |
|---|---|
| Name | The label users see in the Select SFTP server list. Up to 80 characters, none of / \ | " : * ? < > { }, and different from the name of every other entry. |
| Hostname or IP | The address tiCrypt Connect dials, up to 256 characters. It must be an IPv4 address or a domain name with at least one dot; localhost and IPv6 addresses are rejected with "Must be a valid domain name or IP address". The allowlist check matches this host and the port exactly, and two entries cannot share the same host and port. |
| Port | The SSH port of the server, from 1 to 65535. The default is 22. |
| Expiration (optional) | After this date the server no longer appears in users' Select SFTP server list. Leave it empty for a server with no end date. |
| Allowlist | The teams and users who can connect, chosen with a team picker and a user picker. If the allowlist is left empty, nobody in the system can access the server. |
If another entry already uses the same host and port, the pop-up shows a red notice, "An SFTP server "<name>" already exists with hostname "<host>" and port <port>", and the save button stays disabled.
The following table describes the columns of the External SFTP Servers table.
| Column | Description |
|---|---|
| Name | The name of the entry. |
| Hostname | The host name or IP address. |
| Port | The SSH port. |
| Expiration | The expiration date, if the entry has one. |
Admins and Super-admins see every registered server in the Select SFTP server list, but they can connect only to servers whose allowlist includes them or one of their teams.
Create a New SFTP Server
Location: Management > Miscellaneous > External SFTP Servers
- Click the Create SFTP Server button in the top right panel.
- In the Create SFTP Server pop-up, enter the server name, host name or IP address, port, and optional expiration date.
- Under Allowlist, select the teams and users who can connect to the server.
- Click Create.
The server appears in the External SFTP Servers table. The users and team members on its allowlist can now select it under Connect to SFTP server > SFTP bidirectional.
Edit an SFTP Server
Location: Management > Miscellaneous > External SFTP Servers
- Select the SFTP server you want to edit.
- Click the Edit button in the top right panel.
- In the Update <name> pop-up, edit the server name, host name or IP address, port, and optional expiration date.
- Update the teams and users on the Allowlist.
- Click Update.
The change applies to the next connection. A user removed from the allowlist is refused the next time they connect.
View an SFTP Server
Location: Management > Miscellaneous > External SFTP Servers
- Select the SFTP server you want to view.
- Click the View button in the top right panel.
- In the detail panel, review the cards described in the table below.
The following table describes the cards of the SFTP server detail panel.
| Card | Description |
|---|---|
| Basic info | Name, Host, Expiration ("Never" when there is none), Created on, Last modified on and the ID. |
| Allowed users | The users on the allowlist, or "No users". |
| Allowed teams | The teams on the allowlist, or "No teams". |
| Allowed projects | Projects whose members can also connect, or "No projects". Projects cannot be added from the Create SFTP Server or Update pop-up. |
Refresh SFTP Server(s)
bulk-action
Location: Management > Miscellaneous > External SFTP Servers
- Click the Refresh button in the top right panel.
Export SFTP Server(s) in CSV Format
bulk-action
Location: Management > Miscellaneous > External SFTP Servers
- Select the SFTP server(s) you want to export.
- Click the Export CSV button in the top right panel.
- Select the Selected items option.
- In the local window, select the export location.
- Click Save.
Export SFTP Server(s) in JSON Format
bulk-action
Location: Management > Miscellaneous > External SFTP Servers
- Select the SFTP server(s) you want to export.
- Click the Export JSON button in the top right panel.
- Select Export selected items.
- In the local window, select the export location.
- Click Save.
Delete Existing SFTP Server(s)
bulk-action
Location: Management > Miscellaneous > External SFTP Servers
- Select the SFTP server(s) you want to delete.
- Click the Delete button in the top right panel.
- In the confirmation prompt, click Yes. Click No to keep the servers.
The server disappears from users' Select SFTP server list, and new SFTP bidirectional connections to it are refused. Files already pushed to the server stay there.