4U supports transferring of data files via SFTP for the purposes of data sharing with clients. SFTP can be used for automation purposes or for the ad hoc secure transfer of files.

We employ two separate SFTP servers for production and for non-production environments. The latter is used for integration / acceptance testing with our Systems Integration Testing (SIT) environment.

We use a dynamic pool of servers and they do not have fixed IP addresses.

All authentication with our SFTP servers is performed with a user name and an RSA SSH key. We do not use passwords.

Your user names are issued by 4U.

For security reasons, we request that you generate your own RSA keys and share the public portion of the key with us. The private portion of the key is used to configure authentication on your end and should not be shared.

Once the public portion of the key is provided to us, we will configure access for you.

You may provide us with multiple SSH keys and keys can be rotated upon request.

In addition to the in-transit encryption provided by SFTP, we encrypt all data at rest for complete end-to-end encryption.

At rest encryption and decryption is performed automatically using an AES-256 cipher. Files are encrypted within the SFTP session prior to being saved to disk. Conversely, files are decrypted within the SFTP session after being read from disk and prior to transmission to a client.

Every file is encrypted using a file-specific key and that key is, in turn, encrypted using a root key. The root key is rotated regularly. This provides a higher level of security than re-using the same key across multiple files.

We do not support the receipt of files that have been pre-encrypted on the client side (for example, via PGP).