Custom SFTP Setup

Provision secure SFTP report delivery using SSH keys and optional GPG encryption.

Set up a brand-specific SFTP account for secure delivery of standard reports. Access uses SSH keys, IP allowlisting, and optional GPG encryption.

Overview

Reach can deliver standard reports to a brand-specific SFTP folder. Access is restricted by SSH key authentication and IP allowlisting.

Reports can also be available in Reach Central (RC), based on role permissions.

This is a file-based delivery path. It is designed for scheduled exports and reconciliation workflows.

Who this is for

• Brand technical teams (IT, DevOps, security)
• Parent brand administrators (for aggregated reporting)
• External partners who require controlled report access

Scope

Included

• Per-brand SFTP setup and report delivery
• Parent-brand aggregated reports (SFTP and Reach Central, where enabled)
• Role-based visibility (brand vs. parent access)
• GPG encryption and decryption of report files

Not included

• Real-time or streaming delivery
• Password-based SFTP authentication

Access model (brand vs. parent)

Capability	Brand	Parent brand
SFTP folders	Own brand folder only	Parent aggregate folder
Reach Central visibility	Own brand reports only	All child brand reports (aggregated)
Report format	Standard	Standard + brand name column (where applicable)
Cross-brand access	Not permitted	Not permitted outside the parent’s child brands

Parent aggregation depends on correct brand hierarchy mapping in the platform.

Before you start

You must provide

• Egress IP address(es) to allowlist (the machine or NAT IP that will connect)
• SSH public key (RSA 2048-bit) for SFTP authentication
• GPG public key (optional) for encrypting report files

You will receive from Reach

• SFTP endpoint (host)
• Username
• Folder path(s)

SFTP access is key-based only. Password logins are not supported.

Request and onboarding flow

1

Generate an SSH key pair

Create an RSA 2048-bit key pair. Keep the private key secure.

2

Generate a GPG key pair (optional)

Share only the public key. Keep the private key and passphrase secure.

3

Email your setup package

Send the following to [e-mail]:

• allowlist IP address(es)
• SSH public key (.pub)
• GPG public key (ASCII armored, .asc) (optional)

4

Reach provisions access

Reach DevOps creates the SFTP user and configures folder permissions.

5

Validate connectivity and file access

Reach shares the endpoint, username, and folder path. You confirm you can connect, list files, and download files.

SSH key generation (Linux/macOS)

Generate an RSA 2048-bit key pair:

ssh-keygen -t rsa -b 2048 -f brand-sftp-ssh

Outputs:

• Private key: brand-sftp-ssh (do not share)
• Public key: brand-sftp-ssh.pub (share with Reach)

Use a passphrase if your security policy requires it.

GPG key generation (optional)

Prerequisite: gpg must be installed.

Create a key:

gpg --full-generate-key

Find the key ID:

gpg --list-secret-keys --keyid-format=long

Export the public key (share this with Reach):

gpg --armor --export <KEY_ID> > public_key.asc

Export the private key (keep this safe):

gpg --armor --export-secret-keys <KEY_ID> > private_key.asc

Never share private_key.asc. If it leaks, treat it as a security incident.

Connect to SFTP

Use any SFTP client that supports SSH keys. Command-line example:

sftp -i /path/to/brand-sftp-ssh USERNAME@ENDPOINT

Reach provides the exact endpoint, username, and folder path via email.

Decrypt downloaded files

If reports are delivered as .gpg files, decrypt them locally:

gpg --decrypt --output report.csv report.csv.gpg

Security model

• Authentication: SSH key-based (RSA 2048-bit)
• Network control: IP allowlisting
• Authorization: folder-level permissions (brand folder isolation)
• Encryption: GPG-encrypted files on SFTP (optional)
• Key handling: private keys stay with the brand; only public keys are shared

Operational rules and constraints

• SSH public keys must be RSA 2048-bit.
• Only allowlisted IPs can connect.
• Each SFTP user is limited to its assigned folder(s).
• Parent-level reports aggregate child brands based on platform hierarchy mapping.
• Delivery is file-based only. No event streaming or real-time feeds.

Troubleshooting

• Connection refused

  • Confirm your egress IP is allowlisted.
  • If your IP changed, email the updated IP to [e-mail].
• Authentication failure

  • Confirm you are using the correct private key for the registered public key.
  • Confirm the public key provided was RSA 2048-bit.
• Decryption failure

  • Confirm the correct GPG private key is imported on the machine.
  • Confirm you have the correct passphrase.
• Reports missing

  • Confirm folder path and permissions.
  • Confirm the report cadence for that report type.
• Missing sub-brand data in a parent aggregate

  • Confirm brand hierarchy mapping is correct and up to date.

Support

• Setup, access, and SFTP issues: [e-mail]

Reach routes SFTP requests internally to the right team.

Screenshots (optional reference)

Questions or clarification? Reach out to your respective account manager or email at [e-mail] for help and support.