SFTP Connections
Permission requirements
- Vault Files and Directories
- View their directories and their groups' directories
- Create files (needed to upload)
- Upload file content (needed to upload)
- Add items to directories
- Get the keys of their files and files shared with them (needed to download)
- Download the content of files they can access
An SFTP connection is a link that tiCrypt Connect opens from your computer to an SFTP server, signed in with your own account on that server. While the connection is open, the server appears as a drive named SFTP under My Computer in the Vault, and you move files between it and the Vault the same way you move files between the Vault and a folder on your computer. tiCrypt offers two kinds of connection. SFTP inbound only brings files from the server into your Vault. SFTP bidirectional can also send files from your Vault to the server, and works only with servers a Super-admin has approved for you.
An SFTP connection is not an SFTP inbox. An SFTP inbox lets someone without a tiCrypt account send files to you through tiCrypt's own SFTP service. An SFTP connection is you, signed in to tiCrypt, reaching out to an SFTP server someone else runs.
Why there are two kinds of SFTP connection
Bringing data in and sending data out carry different risks, so tiCrypt gates them differently. A file pulled into the Vault is encrypted on arrival and stays under tiCrypt's protection, so SFTP inbound lets you connect to any server you can reach, with no administrator involved. It follows the same rule as the cloud services under Add new cloud service (Box, Dropbox, Google Drive and OneDrive), which are also pull-only.
A file pushed to an SFTP server leaves tiCrypt's protection. It arrives on the server decrypted, and from then on only that server's own controls protect it. Sending data out is an export decision, so SFTP bidirectional does not let you type a server address. You pick from the servers a Super-admin has registered and allowlisted for you or one of your teams, and tiCrypt checks that grant with the backend every time you connect. Each check is logged.
Without the split, every SFTP server would be an exit. If one kind of connection did both jobs, either any server a user could reach would become a way to move data out of the enclave, or every pull from a collaborator's server would wait on an administrator. Two kinds let the common case, bringing data in, stay self-service while the rare case, sending data out, stays approved and recorded.
Neither kind can change what is already on the server. tiCrypt never deletes, renames, moves or overwrites files on an SFTP server, and it does not create folders there. A bidirectional connection only adds new files to folders that already exist.
SFTP inbound and SFTP bidirectional compared
The following table describes how the two kinds of connection differ.
| SFTP inbound | SFTP bidirectional | |
|---|---|---|
| Icon on the drive | Arrow pointing down and to the right | Two arrows pointing in opposite directions |
| Direction | Server to Vault only | Server to Vault, and Vault to server |
| Which servers | Any server your computer can reach. You enter the host and port. | Only servers a Super-admin has registered and allowlisted for you or one of your teams. You pick from a list. |
| Port | You enter it. The default is 22. | Set by the Super-admin with the server. |
| Sign-in | Your user name and password on the server | Your user name and password on the server |
| Checked by tiCrypt when you connect | No | Yes. The backend confirms the server is allowlisted for you, and logs the check. |
| Changes existing files or folders on the server | Never | Never |
When to use each kind
- SFTP inbound: a collaborator, instrument or data provider makes files available on an SFTP server where you have an account, and you want them in your Vault. No administrator is involved.
- SFTP bidirectional: you have to deliver results to an approved destination, such as a sponsor's or coordinating center's SFTP server, and a Super-admin has allowlisted that server for you or your team.
- An SFTP inbox instead: the person sending the data has no tiCrypt account and no SFTP server of their own. Create an SFTP inbox and give them its credentials.
- SFTP to a VM instead: the data has to land inside a running VM rather than in your Vault. Use the VM's own SFTP access, described in VM File Operations.
- A cloud service instead: the files are in Box, Dropbox, Google Drive or OneDrive. Use Add new cloud service, described in Transfer.
Before you begin
- tiCrypt Connect: it must be running, because it makes the connection. Without it, Connect to SFTP server is unavailable. See tiCrypt Connect.
- Network access: your computer must be able to reach the server. The connection goes from your computer, not from the tiCrypt servers, so your network, firewall or VPN must allow it.
- An account on the server: you need your own user name and password on the server. SSH keys are not supported.
- Allowlisting, for SFTP bidirectional: a Super-admin must register the server and add you, or a team you belong to, to its allowlist. A server past its expiration date no longer appears. See External SFTP Servers.
- Project access, for pushing tagged files: you must be an active member of the file's project, with permission to download its files.
Connect with SFTP inbound
- Go to the Vault icon in the top left panel.
- In the left panel, under My Computer, click Connect to SFTP server.
- Select SFTP inbound.
- In the Select SFTP inbound credentials pop-up, click Add a new set of SFTP inbound credentials.
- In Host, enter the host name or IP address of the SFTP server.
- Leave Port at 22 unless the server uses a different port.
- Enter your Username and Password on that server.
- Click Login.
- In Select SFTP inbound drives, keep SFTP ticked and click Accept.
- Click Next.
The Transfer files between My Vault and My Computer window opens. A drive named SFTP with the inbound arrow icon is listed under My Computer, showing the folders your account can see on the server.
The following table describes the fields of the SFTP inbound login form. Login stays disabled until every field is valid.
| Field | Rules and messages |
|---|---|
| Host | Required ("You must specify a host name"), at most 120 characters. Enter a full domain name such as sftp.example.edu, or an IPv4 address. Anything else shows "Must be a valid domain name or IP address". |
| Port | Required ("You must specify a port"). A number from 1 to 65535. It starts at 22. |
| Username | Required ("You must specify a username"), at most 120 characters. A value the form does not accept shows "Must be a valid ID or email". |
| Password | Your password on the server. The form does not require it. |
If the server refuses the connection, the pop-up shows the message from tiCrypt Connect, or "Could not connect to SFTP server".
Connect with SFTP bidirectional
Location: Vault > My Computer > Connect to SFTP server
- Select SFTP bidirectional.
- In the Select SFTP bidirectional credentials pop-up, click Add a new set of SFTP bidirectional credentials.
- In Select SFTP server, choose the server. Each entry shows its name and "host · port", and the hint reads "Select the SFTP server from the list". Servers past their expiration date are not listed. If you click Login without choosing one, the pop-up shows "No server selected".
- Enter your Username and Password on that server.
- Click Login.
- In Select SFTP bidirectional drives, keep SFTP ticked and click Accept.
- Click Next.
The Transfer files between My Vault and My Computer window opens. A drive named SFTP with the two-arrow icon is listed under My Computer. Files can now move in both directions between it and the Vault.
Only servers allowlisted for you, or for a team you belong to, appear in Select SFTP server. If the server you need is missing, or the pop-up reads "No SFTP servers are currently available", ask a Super-admin to allowlist it.
Pull files from an SFTP server into the Vault
This procedure describes how to copy files from the server into the Vault. It works with both kinds of connection.
Location: Vault > My Computer > Transfer files between My Vault and My Computer
- In the right panel of the new window, open the SFTP drive and go to the files or folders you want.
- In the left panel, open the Vault directory that should receive them, for example My Files or a group directory.
- Drag the files or folders from the right panel onto the Vault directory in the left panel.
- In the Upload ... to the Vault? pop-up, review the preview and click Upload.
The files appear in the Vault directory you chose, encrypted like any other upload. Folders keep their structure. The progress shows as an Uploading files task. The files on the SFTP server are unchanged.
You can also pull without the transfer window. On the Vault page, click a folder of the SFTP drive under My Computer so its files show on the right, then drag them onto a Vault folder in the left tree. See Vault File Tree.
Push files from the Vault to an SFTP server
This procedure describes how to send files from the Vault to the server. It works only with an SFTP bidirectional connection.
Files arrive on the SFTP server decrypted. From then on only that server's controls protect them. Push only data you are authorized to export to that destination.
Location: Vault > My Computer > Transfer files between My Vault and My Computer
- In the right panel of the new window, open the SFTP drive with the two-arrow icon and go to the destination folder.
- In the left panel, select the Vault files you want to send.
- Drag the files onto the destination folder in the right panel.
- In the Download ... to your computer? pop-up, review the preview and click Download.
The files are written to the destination folder on the SFTP server. The progress shows as a Downloading files task. The originals stay in your Vault.
You can also push without the transfer window. On the Vault page, open the Vault folder that holds the files, then drag them from the file list onto the destination folder of the SFTP drive under My Computer in the left tree.
- Send files, not folders: tiCrypt cannot create folders on an SFTP server. If you drag a folder, it fails with "Failed to create directory ... in destination" and none of its files are sent. Create the folder on the server with your own SFTP client first, then send the files into it.
- Name conflicts: if the destination already holds a file with the same name, the new copy is given a
numbered name, such as
results (1).csv. Existing files are never overwritten. - Why the pop-up says "Download": tiCrypt treats a push as a download through tiCrypt Connect. The same warning, project checks and download record apply, but the files go to the SFTP server instead of your disk.
What happens next
- Pulled files: tiCrypt Connect reads each file from the server and encrypts it on your computer before it is uploaded. In the Vault it is an ordinary encrypted file that you can share, tag or move into a VM like any other.
- Pushed files: tiCrypt Connect fetches each file from the Vault, decrypts it in memory and streams it to the server without saving a copy on your computer. Files tagged with a project are skipped unless you are an active member of that project with permission to download its files.
- Connection checks: for SFTP bidirectional, the backend confirms the server is allowlisted for you each time you connect and logs the result. A server whose allowlist no longer includes you refuses the next connection.
- How long a connection lasts: tiCrypt Connect keeps the connection open while it runs and does not save your SFTP password. After you close tiCrypt Connect, connect again. Signing in again to the same server with the same user name replaces the earlier connection.
Disconnect from an SFTP server
Location: Vault > My Computer > Connect to SFTP server
- Select SFTP inbound or SFTP bidirectional, whichever you connected with.
- On the card for your account, click the Delete credential button.
- Click Cancel to close the pop-up. Next also closes it, but then opens the transfer window.
Delete credential acts at once, without confirmation. You can also sign out of the server from the settings button next to My Computer: open Credentials, select the account and choose Logout. See Transfer.
The SFTP drive is removed from My Computer and tiCrypt Connect closes the connection to the server. Files already pulled into the Vault, or pushed to the server, are not affected.