> For the complete documentation index, see [llms.txt](https://docs.reachplatform.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.reachplatform.com/technical/bolt-on-setup/custom-sftp-setup.md).

# Custom SFTP Setup

Provision secure SFTP report delivery using SSH keys and optional GPG encryption.

Set up a brand-specific SFTP account for secure delivery of standard reports. Access uses SSH keys, IP allowlisting, and optional GPG encryption.

### Overview

Reach can deliver standard reports to a brand-specific SFTP folder. Access is restricted by SSH key authentication and IP allowlisting.

Reports can also be available in Reach Central (RC), based on role permissions.

This is a file-based delivery path. It is designed for scheduled exports and reconciliation workflows.

### Who this is for

* Brand technical teams (IT, DevOps, security)
* Parent brand administrators (for aggregated reporting)
* External partners who require controlled report access

### Scope

#### Included

* Per-brand SFTP setup and report delivery
* Parent-brand aggregated reports (SFTP and Reach Central, where enabled)
* Role-based visibility (brand vs. parent access)
* GPG encryption and decryption of report files

#### Not included

* Real-time or streaming delivery
* Password-based SFTP authentication

### Access model (brand vs. parent)

| Capability               | Brand                  | Parent brand                                    |
| ------------------------ | ---------------------- | ----------------------------------------------- |
| SFTP folders             | Own brand folder only  | Parent aggregate folder                         |
| Reach Central visibility | Own brand reports only | All child brand reports (aggregated)            |
| Report format            | Standard               | Standard + brand name column (where applicable) |
| Cross-brand access       | Not permitted          | Not permitted outside the parent’s child brands |

Parent aggregation depends on correct brand hierarchy mapping in the platform.

### Before you start

#### You must provide

* Egress IP address(es) to allowlist (the machine or NAT IP that will connect)
* SSH public key (**RSA 2048-bit**) for SFTP authentication
* GPG public key (optional) for encrypting report files

#### You will receive from Reach

* SFTP endpoint (host)
* Username
* Folder path(s)

{% hint style="info" %}
SFTP access is key-based only. Password logins are not supported.
{% endhint %}

### Request and onboarding flow

{% stepper %}
{% step %}

#### Generate an SSH key pair

Create an RSA 2048-bit key pair. Keep the private key secure.
{% endstep %}

{% step %}

#### Generate a GPG key pair (optional)

Share only the public key. Keep the private key and passphrase secure.
{% endstep %}

{% step %}

#### Email your setup package

Send the following to `accounts@reachmobile.com`:

* allowlist IP address(es)
* SSH public key (`.pub`)
* GPG public key (ASCII armored, `.asc`) (optional)
  {% endstep %}

{% step %}

#### Reach provisions access

Reach DevOps creates the SFTP user and configures folder permissions.
{% endstep %}

{% step %}

#### Validate connectivity and file access

Reach shares the endpoint, username, and folder path. You confirm you can connect, list files, and download files.
{% endstep %}
{% endstepper %}

### SSH key generation (Linux/macOS)

Generate an RSA 2048-bit key pair:

```bash
ssh-keygen -t rsa -b 2048 -f brand-sftp-ssh
```

Outputs:

* Private key: `brand-sftp-ssh` (do not share)
* Public key: `brand-sftp-ssh.pub` (share with Reach)

Use a passphrase if your security policy requires it.

### GPG key generation (optional)

Prerequisite: `gpg` must be installed.

Create a key:

```bash
gpg --full-generate-key
```

Find the key ID:

```bash
gpg --list-secret-keys --keyid-format=long
```

Export the public key (share this with Reach):

```bash
gpg --armor --export <KEY_ID> > public_key.asc
```

Export the private key (keep this safe):

```bash
gpg --armor --export-secret-keys <KEY_ID> > private_key.asc
```

{% hint style="danger" %}
Never share `private_key.asc`. If it leaks, treat it as a security incident.
{% endhint %}

### Connect to SFTP

Use any SFTP client that supports SSH keys. Command-line example:

```bash
sftp -i /path/to/brand-sftp-ssh USERNAME@ENDPOINT
```

Reach provides the exact endpoint, username, and folder path via email.

### Decrypt downloaded files

If reports are delivered as `.gpg` files, decrypt them locally:

```bash
gpg --decrypt --output report.csv report.csv.gpg
```

### Security model

* **Authentication**: SSH key-based (RSA 2048-bit)
* **Network control**: IP allowlisting
* **Authorization**: folder-level permissions (brand folder isolation)
* **Encryption**: GPG-encrypted files on SFTP (optional)
* **Key handling**: private keys stay with the brand; only public keys are shared

### Operational rules and constraints

* SSH public keys must be **RSA 2048-bit**.
* Only allowlisted IPs can connect.
* Each SFTP user is limited to its assigned folder(s).
* Parent-level reports aggregate child brands based on platform hierarchy mapping.
* Delivery is file-based only. No event streaming or real-time feeds.

### Troubleshooting

* **Connection refused**
  * Confirm your egress IP is allowlisted.
  * If your IP changed, email the updated IP to `accounts@reachmobile.com`.
* **Authentication failure**
  * Confirm you are using the correct private key for the registered public key.
  * Confirm the public key provided was RSA 2048-bit.
* **Decryption failure**
  * Confirm the correct GPG private key is imported on the machine.
  * Confirm you have the correct passphrase.
* **Reports missing**
  * Confirm folder path and permissions.
  * Confirm the report cadence for that report type.
* **Missing sub-brand data in a parent aggregate**
  * Confirm brand hierarchy mapping is correct and up to date.

### Support

* Setup, access, and SFTP issues: `accounts@reachmobile.com`

Reach routes SFTP requests internally to the right team.

<details>

<summary>Screenshots (optional reference)</summary>

![](https://719837688-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqCk68BPk2GwsjGvR7LAT%2Fuploads%2FqILo8MVOCvwAJeHezniX%2Fimage.png?alt=media\&token=676f3cc7-5b72-4913-aede-c718936b55b5)

</details>

{% hint style="info" %}
Questions or clarification? Reach out to your respective account manager or email at <accounts@reachmobile.com> for help and support.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.reachplatform.com/technical/bolt-on-setup/custom-sftp-setup.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.