- BFSIBanking, Financial Services & Insurance
- IT & ITESIT services, BPM, GCCs & SaaS
- Retail & e-commerceStore chains, D2C brands & marketplaces
- HealthcareComing soon
- ManufacturingComing soon
Fortra GoAnywhere MFT
A partner’s nightly file failed and nobody noticed until settlement. The script that sends it has no owner — Fortra GoAnywhere MFT moves partner, batch and ad hoc files over SFTP, FTPS and AS2 from one console, self-hosted on Windows, Linux, UNIX or IBM i, or rented as Fortra-hosted MFTaaS — with Gateway keeping files out of the DMZ.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The Fortra platform family
This page covers Fortra GoAnywhere MFT — with Gateway, MFTaaS and FileCatalyst acceleration folded in. The rest:
Quick facts
30-second orientation- Product
- Managed file transfer server for B2B partner exchange, scheduled batch jobs, ad hoc sharing and automation
- Maker
- Fortra, LLC of Eden Prairie, Minnesota; privately held, with TA Associates and Harvest Partners among its backers
- Delivery
- Self-hosted on Windows, Linux, UNIX or IBM i, in your own AWS or Azure account, or as Fortra-hosted MFTaaS
- Protocols
- SFTP, SCP, FTPS, FTP, HTTP(S), AS2, PeSIT, email and MQ, plus Amazon S3 and Azure Blob storage
- Automation
- Workflows built from 60+ tasks, a scheduler, monitored folders and triggers; commands and APIs carry no extra fee
- Modules
- Gateway, Agents, Secure Mail, GoDrive, Secure Forms, Open PGP Studio, Threat Protection and FileCatalyst
- Price
- Quote-only, licensed per module or server instance; Secure Mail and GoDrive per user, AS2 per trading partner
- Security record
- CVE-2023-0669 (in CISA KEV from 10 Feb 2023) and CVE-2025-10035 (from 29 Sep 2025); both patched
- India
- No MFTaaS hosting region is published; self-host on your servers or an Indian cloud region to keep files here
- In India via
- TechBag: module scoping, the DR licence, an upgrade-path check and a quote in INR with GST
Understand managed file transfer before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is managed file transfer?
One server that moves files between systems and partners securely, on schedule, with a full audit trail.
FTP servers and scripts vs GoAnywhere MFT — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | FTP servers and scripts | Fortra GoAnywhere MFT |
|---|---|---|
| Partner exchanges | An FTP server and script per partner | SFTP, AS2 and HTTPS from one server |
| Scheduling | Cron jobs nobody owns | Built-in scheduler and folder triggers |
| DMZ exposure | Files parked on a DMZ FTP box | Gateway proxy; files stay inside |
| Audit evidence | Logs scattered across servers | One log of transfers and admin actions |
| Large files | Split archives and couriered drives | FileCatalyst acceleration with auto-resume |
| What it is NOT | — | A staff file-sync app, or patch-free |
The cheapest first step is GoAnywhere’s free 30-day trial: run two real partner flows through it before you pay for a single module.
The four pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
MFT server
The core server hosts the SFTP, FTPS and HTTPS services, runs workflows and logs every transfer and admin action, all managed from a browser console with role-based dashboards.
Gateway
A reverse and forward proxy in the DMZ keeps files and credentials on the internal network; it is a required part of MFTaaS and load-balances on tiers 2 and 3.
Agents
Lightweight agents on branch, plant or partner servers watch folders and move files on schedules set centrally, so remote systems need no scripts of their own.
Hosting
Install it on Windows, Linux, UNIX, IBM i, Amazon EC2 or Azure, or let Fortra host it as MFTaaS, launched in 2020 and covered by a SOC 2 Type 2 report, per Fortra.
A core server runs the transfers, Gateway guards the DMZ, agents reach remote sites, and you choose self-hosting or MFTaaS — whose region is unpublished.
Nine capabilities. Connect, automate, protect.
GoAnywhere MFT replaces FTP boxes and transfer scripts with one audited server — and it runs on IBM i too.
SFTP to AS2 in one server
SFTP, SCP, FTPS, HTTPS, AS2 and PeSIT run side by side; Fortra says its AS2 passed Drummond interoperability testing in Q2 2026.
Storage and SaaS connectors
Transfers reach Amazon S3 buckets and Azure Blob, and cloud connectors cover SharePoint, Salesforce, Dropbox, Box and Google Drive.
FileCatalyst for big files
The FileCatalyst service moves large files up to ten times faster than SFTP or HTTP, Fortra claims, even while a file is still growing.
60+ drag-and-drop tasks
Projects chain more than 60 task types (fetch, encrypt, translate, load into a database, send) without anyone writing a script.
Scheduler and folder watch
A built-in scheduler, monitored folders and event triggers start jobs on upload, download or file change, with alerts when one fails.
Commands, REST and SOAP
Commands and APIs, included at no extra charge, let schedulers, Java or .NET apps and CI/CD pipelines start transfers remotely.
Nothing parked in the DMZ
Gateway proxies inbound partner sessions to the internal server, so no files, open inbound ports or credentials need to live in the DMZ.
AES at rest, PGP keys
Files are encrypted at rest and in motion with FIPS 140-2 validated AES, Fortra says, and Open PGP and SSH keys are managed in-product.
ICAP to antivirus and DLP
Threat Protection passes files over ICAP to antivirus or DLP engines, Fortra’s own email and ICAP gateways included, before release.
Watch Fortra explain GoAnywhere MFT
Three videos from Fortra’s official channel: a 2023 mini demo of the product, and two December 2024 how-tos on Gateway and on sign-in options.
GoAnywhere MFT Mini Demo
A 2:45 demo from May 2023 giving a quick tour of GoAnywhere MFT and how file transfers are set up in it.
How GoAnywhere Gateway Keeps Files Out of the DMZ
A 4:52 explainer from December 2024 on how the Gateway proxy keeps files and credentials out of the DMZ.
GoAnywhere Authentication Options Overview
A 7:16 overview from December 2024 of the sign-in options for users: LDAP, SAML, SSH keys and two-factor.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Most file transfer risk hides in scripts nobody owns. GoAnywhere puts every flow on one audited server.
Here’s what genuinely sets it apart — and exactly where it stops.
One server for every kind of file movement
Banks and manufacturers usually run a tangle of FTP boxes, cron scripts and email attachments. GoAnywhere puts server-to-server batch jobs, partner AS2 and SFTP exchanges, ad hoc user transfers and secure sharing under one console and one audit log, so an auditor asking who sent what gets a single answer.
Runs where your files have to stay
Few MFT servers install on IBM i as well as on Windows, Linux and UNIX; GoAnywhere does, so core-banking and ERP files on Power systems move without a second tool. The same software runs in your own AWS or Azure account, or as Fortra’s hosted MFTaaS if you would rather not run servers at all.
Built for the DMZ and for uptime
Gateway keeps files and credentials out of the DMZ by proxying partner sessions inward, and clustering adds active-active load balancing with automatic failover. A standby needs a disaster-recovery licence, which Fortra sells at a discount; on MFTaaS, Gateway also spreads load on tiers 2 and 3.
Where it stops
Two licence-servlet flaws, CVE-2023-0669 and CVE-2025-10035, were exploited and joined CISA’s KEV catalogue in February 2023 and September 2025; both are patched, but self-hosting puts upgrades on you. No price or MFTaaS hosting region is published, and no Indian customer is named.
The numbers behind the platform
What your GoAnywhere MFT rollout looks like
Map every file flow
List partners, protocols, schedules and the scripts behind them, and mark which flows carry account, card or health data.
Choose where it runs
Pick your own servers, your cloud account or MFTaaS; for MFTaaS, get the hosting region from Fortra in writing first.
Pilot behind Gateway
Put Gateway in the DMZ, move five partners and two batch jobs across, and switch on ICAP scanning for inbound files.
Prove patching and audit
Time an upgrade drill on the cluster, then hand auditors a sample transfer report and check it answers their questions.
Retire the old servers
Move the remaining partners, shut the legacy FTP boxes, and settle the INR quote with the DR licence and maintenance in it.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“Partner SFTP and AS2 jobs that lived in shell scripts now sit in one console, with a log our auditors actually accept.”
“It runs on our IBM i next to the Windows servers, so ERP extracts reach distributors without another tool in between.”
“Gateway let us close inbound ports on internal servers. Partners noticed nothing; our firewall team noticed a lot.”
“Projects took some learning, but PGP encryption plus the database load is now one scheduled job instead of three scripts.”
“After the 2025 licence-servlet advisory we had to upgrade every clustered node in a hurry. Fixable, but it ate a weekend.”
“Module-by-module quoting felt fair, though nobody mentioned the standby DR licence until late in the deal.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and review-site grids score satisfaction, not fit for your estate. So here’s TechBag’s synthesis of the managed file transfer market — tap any vendor to see why it sits where it does.
TechBag MFT Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Quote-only; two KEV entries, both patched.
Deployment Choice × Automation Depth
The grid nobody publishes — how many places a product can run (operating systems, your cloud, a vendor-hosted service) vs how much transfer work it automates without scripts.
Widest OS list incl. IBM i, plus MFTaaS; 60+ workflow tasks.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
GoAnywhere MFT vs the managed file transfer field
Against MOVEit Transfer, IBM Sterling, Axway SecureTransport, Kiteworks and JSCAPE — on deployment, protocols, DMZ design, exploited flaws, price and India data.
| Dimension | Fortra GoAnywhere MFT | Progress MOVEit Transfer | IBM Sterling Secure File Transfer | Axway SecureTransport | Kiteworks | JSCAPE MFT Server |
|---|---|---|---|---|---|---|
| What it is | Fortra’s MFT server | Progress MFT line | Sterling MFT platform | Bank-grade MFT server | MFT in a data vault | Redwood’s MFT server |
| Deployment | Windows to IBM i, or SaaS | Windows Server only | On-prem or containers | Every model offered | Appliance; on-prem costs | Mixed OS, self or SaaS |
| Hosted service | MFTaaS, region unstated | MOVEit Cloud on Azure | Separate SaaS product | Single-tenant cloud | Single-tenant hosting | Two regions, no HA |
| Protocols and B2B | AS2, AS4, PeSIT, MQ | AS1, AS2 and AS3 | EBICS on Standard | PeSIT and AS2 | AS2; SFTP is an add-on | OFTP2 and WebDAV |
| Workflow automation | 60+ tasks, no extra fee | Separate Automation | Event-based routing | Via Flow Manager | 2,000 connectors | Low-code templates |
| DMZ and edge | Gateway proxy | Reverse proxy listed | Proxy in the DMZ | Edge servers in zones | Hardened appliance | MFT Gateway |
| High availability | Active-active cluster | Web farm; DR passive | Always-on design | Zero-downtime upgrades | Scale-out cluster | Self-hosted clusters |
| Exploited flaws (KEV) | Two KEV entries | CVE-2023-34362 | None listed | None listed | None; FTA had four | None listed |
| Integrations | SaaS apps, ICAP, DBs | Outlook and mobile | Venafi, REST | REST and MCP | SIEM, DLP, ATP, CDR | Secrets vaults |
| Pricing model | Per module, per instance | Quote; modules apart | Per connection | Tiered subscription | Users plus add-ons | Unlimited users, partners |
| Published entry price | Not published | Not published | Request a quote | Not published | No MFT price | Not published |
| India presence and data | Self-host for residency | Offices, no region | Self-host; SaaS unclear | Hyderabad office | No India office | Hyderabad; US/EU SaaS |
| Lock-in and exit | Projects to rebuild | Windows and SQL tie | Routes to rebuild | Flows to rebuild | Platform-wide exit | Same code, any host |
| Best fit | IBM i and mixed estates | Microsoft shops | High-volume banks | Partner-heavy banks | Consolidators | Redwood users |
Which approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Fortra GoAnywhere MFT if…
- ✓You need one MFT server across IBM i, Linux and Windows, self-hosted in India
- ✓Partner AS2 and SFTP, batch jobs and ad hoc sharing should share one console and one audit log
- ✓You want a DMZ proxy and active-active clustering without buying a second product
Compare alternatives if…
- ✓You want a vendor-hosted service in a named region: Axway lets you pick the cloud region
- ✓Your estate is Windows and Outlook end to end, which is MOVEit’s home ground
- ✓You want MFT, secure email and file sharing governed together, as Kiteworks sells them
Do not expect…
- ✓A clean exploitation history: two GoAnywhere flaws are in CISA’s KEV catalogue
- ✓A published price, or a published MFTaaS hosting region
- ✓Patching done for you, unless you choose MFTaaS
TechBag has no managed file transfer guide yet, so Fortra GoAnywhere MFT sits outside the category guides. Browse all products to compare it with the rest of the catalogue. →
What do scripted file transfers cost you?
Drag the sliders (scheduled file flows you run; staff-hour cost). The estimate assumes 2 staff hours a month per flow spent fixing failed scripts, chasing partners and pulling logs for audits, and that an MFT server with workflows and one audit log removes 60% of that. Both numbers are assumptions. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Quote only. Fortra prints no price and no INR list for GoAnywhere. It is licensed by module or server component per instance; Secure Mail and GoDrive are per user, the AS2 module counts trading partners, and a standby disaster-recovery licence is required at a discount. MFTaaS is a flat subscription in three tiers, with overage charged only above the monthly storage and bandwidth limits. TechBag returns one INR quote with GST, maintenance and the DR licence shown line by line.
GoAnywhere MFT (self-hosted)
Best when files must stay on your own servers
- Licensed per module and instance
- DR licence required, discounted
- You own patching and upgrades
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
GoAnywhere MFTaaS
Best when you would rather not run servers
- Three flat tiers by storage and bandwidth
- Gateway included and required
- Hosting region not published
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Which release would we run, and how fast must we upgrade when Fortra issues a critical advisory like FI-2025-012?
Can the admin console and licence servlet stay off the internet entirely, with only Gateway facing partners?
If we pick MFTaaS, which country and cloud region hold our files, logs and backups? The DPDP Act makes this ours to answer.
Which modules, server instances, DR licence and per-user or per-partner meters does our quote actually include?
Can transfer and admin logs be kept for 180 days and streamed to our SIEM, as CERT-In’s log retention direction requires?
If a new exploited flaw is found, how and how fast are customers told, so we can still meet CERT-In’s 6-hour rule?
How many AS2 trading partners are licensed, and what does each extra partner cost as our partner list grows?
In what format can Projects, partner profiles, keys and audit history be exported if we move to another MFT product?
Questions buyers ask
Ready to evaluate Fortra GoAnywhere MFT?
List your trading partners, protocols and scheduled jobs, or let a TechBag advisor size the modules, check the upgrade path against both advisories and return the quote in INR.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.