Secure file transfer
The Data transfer harness as a platform of its own. Move files in and out of your cloud storage with isolation per partner, role-based control and a full audit trail.
Zapper Edge MFT as a standalone platform: governed file exchange with partners, on your own cloud storage, with every action logged.
- Azure Blob Storage
- Azure Data Lake Storage Gen2
- Managed SFTP
- Lifecycle tiers
- Microsoft Entra sign-in
- Google sign-in
- Multi-factor pass-through
- Role-based permissions
- Encryption in transit and at rest
- PGP
- Customer-managed keys
- Malware scanning
The challenge
Businesses still move critical files by email attachments, shared drives and legacy FTP servers. Nobody can say who sent what to whom, partners can see more than they should, and every new vendor means another account, another folder and another exception to manage.
Regulated teams carry the extra weight. They must show who accessed which file, keep data in the right region, scan what comes in, and retire what they no longer need. Doing that by hand across partners does not scale and rarely survives an audit.
What it does
Partner organizations
Each partner or team becomes its own organization, a separate data boundary. Users see only their organization's files and folders, so partners never see each other or each other's activity.
File management in the browser
Upload and download files and whole folders, search, preview, rename and organize from a web interface. Large uploads are chunked and resumable, and folder downloads are handled for you.
Managed SFTP
Offer SFTP to partners and systems that need it, with scoped local users on your storage account and managed credentials, including key and password rotation.
Secure Send
Share a stored file with an external recipient through a one-time pickup link, or request files from them through a drop-off link, with code-based verification and governed expiry.
Role-based access and sign-in
Single sign-on with Microsoft or Google accounts, and custom roles with fine-grained file permissions, checked per organization. Sharing and downloading are separate rights.
Protection and lifecycle
Malware scan status on files, geo-fencing of access, PGP-encrypted file handling, soft delete and archive rehydration, plus rules that move data to cheaper tiers or expire it.
Platform capabilities in detail
Twelve areas, each with the controls behind it, so security, IT and compliance teams can see exactly what the platform does.
Security and identity management
Sign-in and access control that work with the identity provider you already use.
Single sign-on
- Sign in with Microsoft Entra ID (Azure AD) or Google Workspace
- Session tokens (JWT) that expire automatically
- Multi-factor authentication passed through from Microsoft or Google
- Every authentication event is logged for audit
Role-based access control
- Seven permission categories: users, roles, organizations, storage, files, logs and AI agents
- Granular per-permission assignments, each with a risk-level badge: Dangerous, Critical, Warning or Info
- Several roles per user; effective permissions are the union of all assigned roles
- Checked in real time on every API call
Tenancy and onboarding
Keep every partner organization apart, and bring new ones on in bulk.
Organization isolation and multi-tenancy
- Complete data isolation between partner organizations
- One organization, one storage account, enforced by the platform
- Protection against insecure direct object reference (IDOR) attacks
- Activity logs filtered and scoped per organization
Customer onboarding by bulk import
- A five-step CSV wizard creates organizations, users, storage accounts and SFTP users in bulk
- Live validation with row-level errors before anything is saved
- Preview every change before it runs
- Partial failures handled: successful items are kept and failed ones can be retried
Policy engine
Rules an administrator sets once and the platform enforces on every transfer, instead of leaving them to each user.
Access policy
- File actions are separate permissions: view, download file, download folder, upload file, upload folder, delete, create folder, search, rename, rehydrate and share
- Permissions are grouped into roles; a user with several roles gets the union of them
- Every action is checked against the user's organization, in real time
- Sharing is its own permission, so a person can download a file without being able to send it on
Sharing policy
- Each organization decides which email domains can receive files
- Limits on file size, number of files and how long a link stays valid
- Applies to every pickup and drop-off link the organization creates
Location policy
- Approved countries for data access, enforced with geo-fencing
- Strict mode blocks access; Audit mode only logs it
Retention policy
- Lifecycle rules move aging files to cheaper tiers or delete them on a schedule
- Soft delete retention keeps removed data recoverable for a set period
Secure Send and sharing
Share a stored file with an outside recipient, or ask an outside party to send you files, without giving them an account.
Pickup links: share a file
- Create a one-time pickup link for a file already in your storage
- The recipient opens a public page and confirms with a one-time code before the download
- Links expire after the period your organization allows
- Sharing needs its own permission, separate from download
Drop-off links: receive files
- Create a drop-off link so an outside sender can deliver files to a folder you choose
- The same code-based verification applies on the public page
- Files land directly in your own cloud storage
Organization governance
- Each organization sets the allowed email domains, the maximum size, the number of files and the expiry for its links
- Link creation and use are recorded in the activity log
File management
Browser-based access to Azure Blob and ADLS Gen2 storage, with no cloud expertise needed.
Browse, search and navigate
- Real-time file and folder browsing with breadcrumb navigation
- Inline search across the current folder and its subfolders
- File details: name, size, last modified date and security status
Upload and download
- Single and bulk upload, up to 1,000 files or 15 GB per batch by default
- Drag and drop, plus folder upload
- Configurable upload modes: memory, disk, or direct to Azure with a short-lived SAS link
- Folder download as a ZIP, with large folders handled by Azure Container Apps
- Progress indicators on every transfer
File operations
- Preview images, PDFs and documents in the browser
- Rename, delete and create folders, each with a permission check
- Rehydrate archived files from the Archive tier to Hot at high priority
- Soft delete: recover accidentally deleted files within the retention window
Data protection and residency
Safeguards that scan files, keep keys under your control and hold data in approved places.
Malware scanning with Microsoft Defender
- Every uploaded file is scanned by Microsoft Defender for Storage
- Clean, Malicious and Not scanned badges in file listings
- Azure Event Grid integration is created and managed by the platform
- EICAR test file support to confirm scanning is working
Customer-managed key encryption
- Use your own Azure Key Vault keys instead of Microsoft-managed keys
- Key rotation, versioning and emergency revocation
- Switch on or off per storage account
- Supports bring-your-own-key (BYOK) requirements
Geo-fencing
- Limit data access to approved countries using Azure Maps geolocation
- Strict mode blocks access; Audit mode only logs it
- Fails closed: in Strict mode an unknown location is denied
- Geo-access events appear in the activity log
Retention and lifecycle
Recover removed data for a set period and move or delete aging files on a schedule.
Blob and container soft delete
- Retention period from 1 to 365 days
- Separate policies for individual blobs and whole containers
- Deleted data stays recoverable from the Azure Portal during the retention window
Data lifecycle management
- Age-based rules that move files to Cool or Archive, or delete them
- Prefix filters to target specific folders or data types
- Rules can be switched on or off without deleting them
- Example policies: archive old logs, delete temporary files, cool down backups
SFTP secure file transfer
Give partners and external systems SFTP access that lands files directly in Azure ADLS Gen2.
SFTP local user management
- Create SFTP users with an SSH key (RSA 4096-bit) or a password
- Container-level permissions: read, write, list and delete
- Map each SFTP account to a specific Zapper Edge user for full traceability
- Enable or disable a user without deleting the account
Credential security
- SSH keys and passwords can be downloaded once, within a 120-second window
- Self-service rotation of SSH keys and passwords
- The SFTP connection string is generated and shown automatically
- Every credential event is recorded in the audit trail
PGP encryption
End-to-end file encryption with industry-standard OpenPGP, for highly sensitive exchanges.
Key lifecycle management
- Generate PGP key pairs in the platform, stored in PostgreSQL or Azure Key Vault
- Import partner public keys, or your own full key pairs
- Expiry tracking with Active and Expired status
- Secure deletion, with a warning before you remove a key that files were encrypted with
File encryption and decryption
- Encrypt files before storage with any registered public key
- Decrypt.pgp files with your organization's private key and passphrase
- Decrypted files are saved to a folder you choose
- All encrypt and decrypt operations, including failures, are logged
Integration and extensibility
An open API and configurable deployment to fit your architecture.
REST API with full coverage
- Covers every platform feature: users, roles, organizations, files, storage, AI, SFTP, PGP, Sentinel and Foundry
- JWT bearer token authentication, with access limited to the caller's organization
- A consistent error format with standard HTTP status codes
- Code examples in JavaScript and TypeScript, Python and cURL
Configuration by environment
- More than 100 settings give fine control over platform behaviour
- Upload limits, chunk sizes, SAS timeouts and logging detail are all configurable
- Azure Key Vault integration for secrets in production
- MSAL configuration for custom identity providers, including Entra External ID
Administration
Tools to manage users, organizations and storage accounts at scale.
User and organization management
- Add, edit, enable, disable and delete users, with full role assignment
- Internal and external user types for risk-aware access
- Colour-coded role risk warnings when creating or editing users
- Safeguard: the last active administrator cannot be deleted or disabled
- Multi-organization support, with data access scoped per organization
Storage account management
- Provision new Azure Blob or ADLS Gen2 storage accounts from the platform
- Register existing Azure storage accounts to manage them
- One organization per storage account, with multi-organization sharing through separate containers
- SFTP on and off switch for ADLS Gen2 accounts
Audit and monitoring
A full record of activity, streamed to the tools your security team already uses.
Activity logs and audit trail
- A complete log of user actions: file operations, user management, role changes, storage events and AI operations
- Two storage options: internal PostgreSQL, or Azure Monitor and Log Analytics for Sentinel
- Search and filter by user, action, date range, organization and status
- Export to CSV or JSON for compliance reporting
- Logging controls per action type to manage database growth
Microsoft Sentinel SIEM integration
- Pre-built detection rules that deploy to Sentinel in one click
- A rule catalogue with install, enable, disable and delete
- Security events streamed to a custom Sentinel table
- View Sentinel incidents from inside the platform
How it works
Set up organizations
Create an organization for each partner or team, connect storage, and assign users to roles. Each organization is bound to its own storage location.
Move files in
Users upload in the browser, partners deliver over SFTP, or external senders use a drop-off link. Files land directly in the organization's cloud storage.
Control and share
Roles decide who can view, download, rename, delete or share. Outside recipients receive time-limited pickup links, and access can be limited by country.
Prove and retire
Every action is written to the activity log, searchable and exportable. Lifecycle rules then tier, archive or delete data on the schedule you set.
Under the hood
- Storage
- Azure Blob Storage
- Azure Data Lake Storage Gen2
- Managed SFTP
- Lifecycle tiers
- Identity and access
- Microsoft Entra sign-in
- Google sign-in
- Multi-factor pass-through
- Role-based permissions
- Time-limited access links
- Protection
- Encryption in transit and at rest
- PGP
- Customer-managed keys
- Malware scanning
- Geo-fencing
- Operations
- Event-driven processing
- Containerized workers
- Searchable audit log
- Sentinel integration
- REST API
Business outcome
Partners exchange files without risk. External parties get exactly the access they need, in a space separated from every other partner, with no shared folders or mailbox attachments.
Legacy FTP retired. A governed web interface and managed SFTP replace unmanaged servers and shared accounts, while partners who need SFTP can keep using it.
Audit questions answered quickly. When someone asks who accessed a file, the answer is a search on the activity log, with an export available for auditors.
Storage cost under control. Lifecycle rules move aging data to cheaper tiers and remove what is no longer needed, instead of leaving it for someone to clean up.
Where it is used
- A finance team exchanges statements and reports with outside auditors and vendors, each in a separate, access-controlled space.
- A healthcare group receives files from clinics and labs, with scan status and a full record of who opened what.
- A company replaces an aging FTP server with managed SFTP so partner systems keep their existing connections.
- A legal or HR team sends a sensitive file to one external person through a one-time link that expires.
Frequently asked questions
Is this the same as the Data transfer harness?
Yes. It is that harness delivered on its own, for teams that need governed file movement first. The wider harnesses can be added later as your AI adoption grows.
Where is the data stored?
In your own cloud storage account, in the region you choose. Zapper Edge governs access to it, so data residency stays a decision you make and not one the platform makes for you.
Can partners use SFTP instead of the web interface?
Yes. Managed SFTP is available for partners and systems that need it, with scoped users and credentials that can be rotated. Browser access and Secure Send links are the alternatives.
Does it make us compliant with HIPAA or GDPR?
No product can do that alone. The controls are designed to align with frameworks such as HIPAA, SOC 2 and GDPR, supporting your own compliance work. Zapper Edge does not hold certifications on your behalf.
Can we use our own encryption keys?
Yes. You can encrypt a storage account with your own Azure Key Vault keys instead of Microsoft-managed keys, with rotation, versioning and revocation, switched on or off per storage account.
Does it connect to our security tools and other systems?
The platform has a REST API that covers every feature, and it can send audit events to Azure Monitor and Microsoft Sentinel. Identity can come from Microsoft Entra ID, Google Workspace or a custom provider.
See it on your own documents and data
Tell us what you want to automate and we will show you how it runs inside the harness.