GetSFTP Terms of Service

Effective date: November 11, 2026

These Terms of Service ("Terms") are an agreement between NoteWord, LLC, a Delaware limited liability company that provides the GetSFTP service, 300 W Valley Blvd #3022, Alhambra, CA 91803 ("we", "us"), and the business, or the individual acting for their business or profession, that creates an account ("Customer", "you"). They govern your use of GetSFTP: the SFTP and FTPS service at sftp.getsftp.com, the customer portal and web file client at app.getsftp.com, the management API at api.getsftp.com, and the website at getsftp.com (together, the "Service").

Business and professional use only. The Service is only for use in a trade, business, craft or profession. Companies and other organizations may sign up, and so may individuals working on their own account, for example freelancers, consultants and sole proprietors. The Service is not offered to consumers, meaning people acting for purposes wholly or mainly outside their trade, business, craft or profession, and it must not be used for personal, family or household purposes. When you create an account you confirm that you are acting for business or professional purposes, and we rely on that confirmation.

Who the Customer is. If a company or organization name is entered for the account, the Customer is that company or organization, and you confirm that you have authority to accept these Terms for it. Otherwise the Customer is you personally, acting for your business or profession. You must be at least 18 years old to create an account.

These documents form part of the Terms:

the Acceptable Use Policy ("AUP");
the Data Processing Addendum ("DPA"), which applies whenever we process personal data on your behalf;
the plan description and limits shown on the pricing page at https://getsftp.com/pricing and in the portal at the time you subscribe ("Plan").

If these Terms and the DPA conflict on the processing of personal data, the DPA wins. Our Privacy Policy explains how we handle personal data as a controller. It is a notice, not part of this contract.

1. The Service

1.1 What we provide. A hosted file transfer service: SFTP, FTPS (explicit TLS only) and HTTPS web access to files stored for your organization, with user and folder permissions, activity notifications, an audit log and a management API. Features depend on your Plan.

1.2 Plan limits. Each Plan has limits (for example the number of SFTP users, storage, file count, included downloads, audit log retention and fair-use request volumes). The current limits are published on the pricing page and returned by our API. They are not repeated in these Terms. Storage and file-count limits are hard limits: when your organization reaches one, new uploads are refused until you free up space or move to a larger Plan. We do not bill overage. If your downloads regularly exceed your Plan's included amount, we may ask you to move to a larger Plan. "No connection cap" means we do not set an artificial limit on concurrent connections. Fair-use limits still apply to protect the Service for all customers.

1.3 Availability. We run the Service with a 99.5% uptime target (no high availability). The Service runs on a single compute instance, so planned maintenance and failures of that instance cause downtime. We announce planned maintenance in advance where we can and publish status at https://status.getsftp.com. The uptime target is a goal, not a guarantee, and does not entitle you to service credits unless a separate signed order says so.

1.4 Static IP. We publish the IP address that the Service uses for inbound connections and outbound webhooks. We will give at least 90 days' notice by email before changing it, except where an emergency change is needed to keep the Service secure or available.

1.5 Changes to the Service. We may add, change or remove features. If we remove a material feature of your paid Plan, we will give you at least 30 days' notice. If you do not accept the change, you may cancel and receive a pro-rata refund of prepaid fees for the unused term.

1.6 Beta features. Features labelled beta or preview are provided as-is, may change or end at any time, and are excluded from any uptime target.

2. Accounts and security

2.1 You are responsible for your organization's account users, SFTP users, customer folders, passwords, SSH keys, API keys and permissions, and for everything done through them.

2.2 You must keep passwords, private keys and API keys confidential, use two-factor authentication for account users where available (we recommend turning on the organization's "require 2FA" setting), and tell us promptly at [email protected] if you suspect unauthorized access.

2.3 Account users, SFTP users and customer folders. Account users manage your organization in the portal. SFTP users log in to the file service and count toward your Plan's limit. You can create customer folders and limit an SFTP user to one customer folder, for example so that your own clients can exchange files with you. Everyone you give access to acts on your behalf and does not become our customer. You are responsible for choosing who gets access, for having the right to give it, for the permissions you set, and for their compliance with the AUP.

2.4 Support access. Our support staff see account metadata only. They can access file contents only inside a time-boxed support session that an owner of your organization grants and can revoke at any time. Support sessions are recorded in your audit log.

3. Free trial

3.1 New organizations can use a free trial for 7 days. No payment card is required. The trial has reduced limits and some features are disabled, as described on the pricing page. We allow one trial per organization and may refuse or end trials we reasonably believe are abusive.

3.2 If you do not subscribe by the end of the trial, your organization is locked: SFTP, FTPS, web and API file access stops, but your data is kept. Subscribing unlocks it immediately.

3.3 Data of a locked trial organization is permanently deleted 90 days after the lock. We send reminder emails before the trial ends and several warning emails before deletion to the organization's owners. Deletion is described in section 7.

4. Fees, billing and taxes

4.1 Paid Plans are billed in advance, monthly or annually, through our payment processor Stripe. Prices are those published on the pricing page or in a signed order when you subscribe. Payment card details are entered directly with Stripe. We never see or store full card numbers.

4.2 Automatic renewal. Your subscription renews automatically at the end of each billing period for the same period (a month for monthly billing, a year for annual billing). We charge your payment method on file at the start of each new period, at the price then in effect (see 4.5), until you cancel. You can turn off renewal at any time in the portal (section 7.2). If you do so before the renewal date, you will not be charged again. For annual billing, we email your organization's owners 21 days before each renewal with the renewal date, the amount, and how to turn off renewal.

4.3 Plan changes. Upgrades, and switches from monthly to annual billing, take effect immediately and are prorated by Stripe. A downgrade within the same billing period is also prorated, as a credit toward your next invoices. A switch from annual to monthly billing takes effect at the end of the current annual term. Credits from a downgrade apply only to future invoices. They are not paid out, and they lapse if the subscription ends.

4.4 Fees exclude taxes. We collect sales tax, VAT or similar taxes where required, calculated by Stripe Tax based on the billing details you provide. If you give a valid VAT or similar tax ID, reverse charge may apply. You are responsible for the accuracy of your billing details.

4.5 We may change prices for future billing periods with at least 30 days' notice by email. The change applies from your next renewal after the notice period.

4.6 Failed payments. If a payment fails, we retry and email you. If payment is still outstanding 14 days after the first failed payment, your organization is locked as described in section 7.

4.7 Except where these Terms or the law say otherwise, fees are non-refundable. If you cancel during an annual term, you keep the Service until the end of that term and the unused part is not refunded. There is no cancellation fee.

4.8 Annual renewal refund. If an annual subscription renews and you did not mean to renew, email [email protected] from an owner's address within 14 days after the renewal charge. We will refund that renewal charge in full and end the subscription at once. Your organization is then locked and deleted as described in section 7.3. This applies to annual renewals only, not to the first payment or to monthly billing.

5. Your data

5.1 Ownership. You (or your licensors) own the files and other content you or your users upload ("Customer Data"). We claim no ownership of Customer Data.

5.2 Our licence to process it. You grant us a limited licence to host, copy, transmit, scan for malware and otherwise process Customer Data only as needed to provide, secure and support the Service, to follow your instructions, and as required by law. The DPA governs any personal data in Customer Data.

5.3 What we do not do. We do not sell Customer Data, use it for advertising, or use file contents to train machine-learning models. We never log file contents. Our audit log records events (for example who uploaded, downloaded, deleted or renamed which file, when, from which IP address and over which protocol), not what is inside files.

5.4 Meaning of "read". In notifications and the audit log, a "read" or "download" means a completed file download. SFTP has no separate "opened" or "viewed" event, and directory listings are not reported as reads.

5.5 Your responsibilities for Customer Data. You are responsible for the lawfulness of Customer Data, for having the rights and notices or consents needed to upload it and share it with the people you give access to, and for keeping your own copies of data you cannot afford to lose. We rely on the durability of our storage provider and do not keep separate backup copies of your files. If your Plan includes versioning, earlier versions of changed or deleted files are kept for 30 days. Versioning is not a backup, and changes made through the S3 API are not versioned.

5.6 Regulated data. Unless a separate signed agreement with us expressly allows it, you must not upload payment cardholder data, protected health information or other data whose hosting requires certifications or contract terms we do not offer. See the AUP.

5.7 Export. Owners can export organization metadata, the audit log and files through the portal and API at any time, including while the organization is locked.

6. Acceptable use, suspension and freezing

6.1 You must follow the AUP and make sure your account users and SFTP users do too.

6.2 We may suspend or freeze your organization, or a user in it, without prior notice if we reasonably believe that it breaches the AUP or the law, threatens the security or integrity of the Service or other customers, or exposes us to legal liability. A freeze disconnects active sessions and blocks all access. Where the law and the circumstances allow, we will tell you why and give you a chance to respond, and we will restore access once the issue is resolved.

6.3 We may remove or quarantine specific files that our malware scanning flags or that we are legally required to remove. Quarantined files are permanently deleted after 30 days. Copyright complaints and counter-notices follow AUP section 4. We terminate, in appropriate circumstances, the accounts of repeat infringers.

7. Term, cancellation, lock and deletion

7.1 These Terms apply from account creation until your organization is deleted.

7.2 Cancellation. You may cancel at any time in the portal. The Service continues until the end of the paid period. After that, the organization is locked.

7.3 Lock and deletion for paid organizations. When a paid organization is locked (cancellation or unpaid invoices), file access stops but data is kept for 90 days so you can pay, resubscribe or export it. After that period we permanently delete it.

7.4 Deleting your organization. The owner can delete the organization in the portal at any time. Access stops at once and the subscription will not renew. Fees already paid are not refunded (section 4.7). The organization is permanently deleted 30 days later, and until then the owner can cancel the deletion. If you cancel the deletion, renewal stays off: subscribe again in the portal to keep the Service after the paid period. The owner can instead choose immediate deletion, which cannot be undone. Export anything you need first. Deleted customer folders and their SFTP users can be restored for 30 days, then are permanently deleted.

7.5 What deletion covers. Deletion removes all files stored under your organization (including any versions and quarantined files), your account users' logins, your SFTP users and their passwords and keys, notification rules and the organization's audit log, and removes personal data from our records. Files in a storage bucket of your own are not deleted (section 12.10). We keep only the minimum records the law requires or permits (for example invoices, tax records and a record that deletion took place, which contains no personal data). Encrypted database backups that contain your account metadata expire on their own within 35 days and are not restored except to recover the Service from a disaster. We email the organization's owners when deletion is complete.

7.6 We may terminate these Terms for material breach that is not cured within 30 days of notice, or immediately for serious or repeated AUP breaches.

7.7 Sections 4 (for fees already due), 4.7, 5.1, 5.3, 7.5 to 7.7, and 8 to 12 survive termination, together with any other provision that by its nature is meant to survive.

8. Confidentiality and security

8.1 Each party will protect the other's confidential information with reasonable care and use it only to perform under these Terms.

8.2 We maintain the technical and organizational measures described in the Security Overview and Annex II of the DPA. We may improve them over time but will not materially reduce the overall level of protection during your subscription.

8.3 We will notify you of a security incident affecting your Customer Data as set out in the DPA.

9. Warranties and disclaimers

9.1 Each party confirms it has the authority to enter these Terms.

9.2 Except as expressly stated in these Terms, the Service is provided "as is" and "as available". To the fullest extent the law allows, we disclaim all implied warranties, including merchantability, fitness for a particular purpose and non-infringement. We do not warrant that the Service will be uninterrupted or error-free, or that malware scanning will detect every malicious file.

10. Liability

10.1 Neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue or goodwill, even if advised of the possibility.

10.2 Each party's total liability arising out of these Terms is limited to the fees you paid us in the 12 months before the event giving rise to the claim. For free trials, and for any period in which you have paid us nothing, our total liability is limited to US$100.

10.3 The limits in 10.1 and 10.2 do not apply to (a) your obligation to pay fees; (b) your obligations under section 11.1; (c) a party's fraud, gross negligence or wilful misconduct; or (d) liability that cannot be limited by law, including liability for death or personal injury caused by negligence. Our total liability under section 11.2 is limited to three times the amount in 10.2.

11. Indemnity

11.1 By you. You will defend us against third-party claims arising from Customer Data, from your instructions to us, or from use of the Service by you, your account users or SFTP users in breach of these Terms or the AUP. You will pay the damages and costs finally awarded, or agreed in a settlement you approve.

11.2 By us. We will defend you against third-party claims alleging that the Service, as we provide it, infringes a patent, copyright or trademark or misappropriates a trade secret. We will pay the damages and costs finally awarded, or agreed in a settlement we approve.

11.3 Exclusions. Section 11.2 does not apply to claims arising from (a) Customer Data; (b) use in breach of these Terms or the AUP; (c) combination with products, data or processes we did not provide, where the claim would not exist without the combination; (d) changes not made by us; (e) beta features or free trials; or (f) open-source components used under their own licences, unless we modified them.

11.4 Remedies. If the Service is, or in our opinion is likely to become, the subject of such a claim, we may at our option get you the right to keep using it, or modify or replace it without materially reducing its functionality. If neither is commercially reasonable, we may end your subscription and refund prepaid fees for the unused term. This section 11 is our entire liability, and your only remedy, for infringement claims.

11.5 Procedure. The party asking for defence must notify the other promptly in writing. A delay reduces the other party's obligations only to the extent it causes prejudice. That party must also give the defending party sole control of the defence and settlement, and reasonable help at the defending party's cost. No settlement may admit fault for the defended party, or impose obligations on it, without its consent, which may not be unreasonably withheld.

12. General

12.1 Governing law and disputes. These Terms are governed by the laws of the State of California, USA, without regard to conflict-of-laws rules. The UN Convention on Contracts for the International Sale of Goods does not apply. Before starting a lawsuit, a party must email the other a written description of the dispute, and both will try in good faith to resolve it for 30 days. The state and federal courts located in Los Angeles County, California have exclusive jurisdiction, and each party consents to them. Either party may bring a qualifying claim in small-claims court, or seek urgent injunctive relief in any competent court. To the extent the law allows, each party may bring claims only individually, not as a plaintiff or class member in a class or representative action. A claim must be brought within one year after it arises, unless the law requires a longer period. Mandatory law that protects you and cannot be waived is not affected.

12.2 Changes to these Terms. We may update these Terms. For material changes we will email account owners at least 30 days before they take effect. Continued use after that date means acceptance. If you object, you may cancel before the change takes effect and receive a pro-rata refund of prepaid fees.

12.3 Open-source software. The Service uses open-source components, including an SFTP server licensed under the GNU Affero General Public License v3. We use it unmodified. Notices, licence texts and links to the source code are on our About page.

12.4 Export controls and sanctions. You will not use the Service in breach of US or other applicable export control or sanctions laws. You confirm that you and your users are not located or ordinarily resident in a country or region under comprehensive US sanctions, and are not named on, or owned or controlled by anyone named on, a US government restricted-party list.

12.5 Notices and electronic communications. We send notices, invoices and other communications electronically, by email to your organization's owners and, where suitable, in the portal. They satisfy any legal requirement for written communications. An email notice is treated as received when sent, unless we get a delivery failure, so keep the owners' email addresses current. Send operational notices to [email protected]. Send legal notices (breach, termination, disputes) by email to [email protected] with the subject "Legal notice", and by mail or courier to NoteWord, LLC, 300 W Valley Blvd #3022, Alhambra, CA 91803.

12.6 Assignment, force majeure, entire agreement. Neither party may assign these Terms without the other's consent, except to a successor in a merger or sale of substantially all relevant assets. Neither party is liable for delays caused by events beyond its reasonable control. These Terms, with the documents listed at the top, are the entire agreement about the Service and replace earlier discussions. If any provision is unenforceable, the rest remains in effect.

12.7 Our intellectual property. We and our licensors own the Service, its software, documentation and branding. During your subscription we give you a non-exclusive, non-transferable right to use the Service for your business. Your account users, SFTP users and clients may use it on your behalf. You must not resell the Service or make it available to others except as these Terms allow, or reverse engineer it, except where the law or an open-source licence permits. We reserve all rights not expressly granted.

12.8 Feedback. We may use suggestions and feedback you send us freely, without obligation to you.

12.9 Publicity. We will not name you or use your logo as a customer without your prior written consent, which you may withdraw at any time.

12.10 Third-party services. If you connect the Service to services you choose, such as Slack, Microsoft Teams, webhook endpoints, external SFTP or S3 targets, a sign-in provider or your own storage bucket, your use of them is governed by your terms with their providers. We are not responsible for those services, or for data once it reaches them. If you use your own bucket, you are responsible for its settings, costs and availability, and for any data left in it after your organization is deleted.

12.11 Precedence and interpretation. If documents conflict, this order applies: a signed order with us; the DPA (for personal data); these Terms; the AUP; the Plan description. The parties are independent contractors. There are no third-party beneficiaries. Not enforcing a provision is not a waiver. "Including" means "including without limitation". These Terms are written in English, and any translation is for convenience only.

Questions: [email protected].