NetSuite SFTP Integration: SuiteApp vs N/sftp Recovery

Executive Summary

NetSuite SFTP integration should be selected by control boundaries and recovery requirements. The bank-focused SFTP Connector SuiteApp is a starting point when its file-and-folder workflow fits the exchange. Custom N/sftp is appropriate when the organization can own selection, state tracking, and exception logic. An iPaaS can coordinate transport and downstream processing, while an external managed transfer layer can supply endpoint, storage, and routing capabilities. NetSuite itself is not an SFTP server: N/sftp transfers must originate in SuiteScript against an external endpoint. ^[1] AWS SFTP connectors, for example, connect remote servers with S3 storage rather than automatically completing a NetSuite handoff. ^[2]

The constraints documented in the sources reviewed for this report are materially different. N/sftp upload has a 100 MB maximum and a default 300-second timeout that measures inactivity rather than total transfer duration. ^[3] File.getContents separately limits in-memory content to 10 MB. ^[4] AWS documents SFTP connector files up to 150 GiB, with 12-hour transfer and wait limits; those figures do not enlarge NetSuite's limits. ^[5] Celigo documents up to four retry attempts for intermittent errors with auto-resolution enabled. A retry policy is not evidence that an ambiguous upload can safely be replayed. ^[6]

Identity, network, and payload protection require separate lifecycle plans. Oracle lists Connector authentication methods and host-key types, but also states that SFTP is supported with the IP allow list disabled. Bank source-address requirements therefore need explicit architecture validation. ^[7] Google Cloud and Files.com document outbound address options that may serve that requirement in an external design. ^{[8] [9]} Host keys must be verified independently: OpenBSD warns that collecting a key does not authenticate it. ^[10] OpenPGP protects file contents beyond the transport session and introduces its own keys and retention requirements. ^[11]

The recommended operating model tracks each logical file through produced, encrypted, uploaded, acknowledged, processed, archived, retried, and quarantined states. A processed folder proves only its documented transport action. Before replay, establish the recipient's last proven outcome. Agree recovery time and recovery point objectives with the business owner, then test rotation and restoration against them; no numerical objectives are invented here. ^{[12] [13]} This report is a documentation-based comparison reviewed as of October 2026, not a live-account benchmark or account-specific compatibility certification.

Introduction and Background

NetSuite SFTP integration is a file-exchange architecture, not simply a connection setting. Secure File Transfer Protocol (SFTP) carries files over Secure Shell (SSH), whose transport specification covers encryption, server authentication, and integrity protection. Those properties secure the connection; they do not establish whether a payroll processor, tax authority, bank, or trading partner accepted the contents. ^[14]

The essential direction constraint is that NetSuite does not operate an SFTP server. Transfers using N/sftp must originate in SuiteScript against an external server. A partner's request to “push into NetSuite over SFTP” therefore requires an external receiving endpoint and a separate NetSuite retrieval step. ^[1] An external layer can supply that endpoint: for example, AWS Transfer Family connectors move files between Amazon S3 and remote SFTP servers. That capability still leaves the NetSuite handoff to be designed. ^[2]

This report compares the SFTP Connector SuiteApp, custom N/sftp, an integration platform as a service (iPaaS), and an external managed transfer layer. It also includes an implementation-service route because selecting software and assigning responsibility for building and operating it are related decisions. Houseblend publicly offers NetSuite integration services spanning finance, electronic data interchange (EDI), and other business systems. That establishes its service role, not a separate SFTP protocol or a product benchmark. ^[15]

The fit test should begin with the receiving party's contract:

• Bank-file exchange: Evaluate the Connector when the required files and folder workflow match its documented bank-payment purpose. ^[16]
• Custom partner workflow: Evaluate custom code when the team needs explicit control over identity, state, and exceptions.
• Cross-application orchestration: Evaluate iPaaS when file movement belongs inside a wider integration process.
• Network-constrained exchange: Evaluate an external layer when the endpoint requires controlled outbound source addresses. Files.com documents that capability for supported remote-server connections. ^[9]
• Operational ownership: Select the people and service model alongside the transport.

Payment approval and financial reconciliation are outside this report. Its concern is proving what happened to each file and recovering safely when that proof is incomplete.

NetSuite SFTP Connector SuiteApp

Capabilities

The Connector is bank-file oriented. Oracle documents transferring payment files from NetSuite to bank servers, downloading bank-server files, and working with Electronic Bank Payments. Transferred files move into a processed File Cabinet folder as backups; downloaded files can move into the bank's processed folder subject to bank-side permissions. These movements are transport housekeeping, not evidence that the bank completed business processing. ^[17]

That distinction matters when a downstream integration treats a folder called “processed” as an acceptance signal. A broader orchestration platform can also move or delete files after reading them: Boomi explicitly defines a post-read Delete action as removal after successful reading. Reading and business acceptance should remain separate milestones in the operating design. ^[18]

Oracle documents AES 128, AES 192, and AES 256 for the Connector's outbound payload encryption and Node Forge for its decryption configuration. ( Oracle encryption documentation ( Oracle decryption configuration Plan secure delivery of the generated passkey file to the bank or other recipient, coordinate passkey changes, and retain the material needed to decrypt historical files under the retention policy. If a partner requires OpenPGP, validate that requirement separately and use a suitable additional component where needed; SFTP support alone should not be treated as proof of OpenPGP compatibility.

Use the Connector where its supported workflow fits the exchange agreement. Prefer a dedicated staging folder containing only files authorized for that run. Maintain a separate file register so an administrator can answer which logical file was staged, transferred, acknowledged, and retained, even when the folders have changed.

Adoption

Treat installation as a controlled application change. Oracle describes the Connector as an unmanaged SuiteApp that requires manual updates through the Marketplace. Document the installed version and test any update in the appropriate account before production use. A NetSuite platform upgrade should not be assumed to have applied a Connector update. ^[19]

Access review should include the File Cabinet as well as configuration records. Oracle states that the SFTP Operational role has full File Cabinet access. A role capable of moving files may therefore expose more data than the specific integration requires; inspect the effective permissions before assigning it. ^[20]

Scheduling also needs an operational owner. Define who places eligible files into staging, who monitors the transfer, who checks the acknowledgment deadline, and who authorizes a rerun. A reminder field elsewhere in the stack is insufficient by itself: MuleSoft Partner Manager explicitly describes its SSH-key expiration date as a reminder that the platform does not enforce. ^[21]

Strengths and Limitations

Oracle lists single-factor and multi-factor authentication methods and RSA, DSA, and ECDSA host-key types for the Connector. Its limitations page also says, “Supports SFTP with disabled IP allow list.” Treat a bank requirement for fixed source IP addresses as an architecture checkpoint rather than assuming a direct Connector configuration will satisfy it. ^[7] External alternatives should be assessed against their documented outbound behavior; Google Cloud, for example, provides region-level static source-address configuration for connections to public backends. ^[22]

Manual recovery is a folder-level operation. Oracle instructs users to repeat a manual transfer when files remain pending and says that a specific payment file cannot be selected from the folder. Before rerunning, identify the remaining files and establish whether any previously attempted upload reached the recipient. ^[23] Boomi's post-read options illustrate why folder movement alone should not become the universal recovery authority. ^[18]

Inbound cleanup is also permission-dependent. Oracle instructs users to leave the bank processed-folder field blank without the bank's Delete and Upload permissions. Document what happens to already-downloaded source files in that configuration, including the local duplicate check. ^[24] A recovery target should describe the business deadline for restoring the exchange, using a defined recovery time objective rather than an assumed product guarantee. ^[12]

Custom NetSuite N/sftp Integration

Capabilities

Custom SuiteScript offers control over file selection, naming, sequencing, and the durable record of each attempt. Strict host-key verification remains mandatory: Oracle says the script must know the server's host key beforehand and provides no switch to disable the check. ^[25] Capturing a key is a separate activity from trusting it. OpenBSD warns that ssh-keyscan cannot authenticate the keys it retrieves; verify the result through an independent bank or partner channel. ^[26]

Authentication and server identity are different controls. The current createConnection API accepts a password GUID, SSH key ID, or secret ID; permits documented key-plus-password combinations while rejecting secret plus passwordGuid; allows a 1 to 20-second connection timeout with a 20-second default; and distinguishes FTP_INCORRECT_HOST_KEY from invalid credentials or directory access. ^[27] SSH's transport specification likewise treats server authentication as part of the connection's security properties. ^[14]

Code should make file-state updates explicit. Persist the intended operation before the network call, then record the result and available remote evidence. When a call ends without a conclusive result, use an “outcome unknown” condition under retry or quarantine. Never infer that the remote file is absent merely because the local call failed.

Adoption

Key deployment needs environment-specific preparation. Oracle requires PEM-formatted private keys and says a production key must be uploaded again into a refreshed sandbox. A refresh is therefore not proof that the sandbox can execute the same authenticated transfer. ^[28] Keep production and test endpoint registers separate, including their independently verified server-key fingerprints. OpenSSH documents fingerprint display through ssh-keygen. ^[29]

Permission review must include execution context. Oracle's Key Access permission governs access through scripting; access to the key-management screen should not be treated as equivalent permission to use a key in a deployed script. ^[30] Record the role, deployment identity, permitted scripts, account, and endpoint together.

Use a written cryptographic lifecycle rather than an unsupported universal rotation interval. NIST defines a cryptoperiod as the span during which a specific key is authorized for use. The appropriate interval is a policy and partner-contract decision that must be implemented and tested. ^[31]

Strengths and Limitations

Custom code makes recovery behavior reviewable, but the team owns its implementation. Include concurrency controls, durable checkpoints, retry classification, acknowledgment matching, and operator tooling in the estimate. MuleSoft's documentation provides a useful boundary example: its FTP/SFTP file locks protect flows within the application, not external processes. A locally successful lock does not establish a global partner-level duplicate barrier. ^[32]

Cipher compatibility needs a current-account test. Oracle's cipher page opens with aes128-ctr, aes192-ctr, or aes256-ctr support as a requirement but also presents a broader interoperability table. It lists EDDSA signatures while the API's hostKeyType choices remain RSA, DSA, and ECDSA; that does not establish an ED25519 hostKeyType. This documentary discrepancy does not establish that every listed algorithm works for every account, server, or release. Preserve the negotiated algorithm in the acceptance evidence. ^[33]

Optional payload encryption has a separate constraint. Oracle's N/pgp supports file encryption and signing in SuiteScript, but the module operates on strings and data that fits into memory. Do not infer a streaming encryption pipeline from the fact that a larger file can be transferred over SFTP. ^[34] OpenPGP provides confidentiality and integrity for the message or file itself, making it relevant when protection must continue beyond the SSH session. ^[11]

iPaaS for NetSuite SFTP

Capabilities

An iPaaS can centralize scheduling, transformation, error handling, and the handoff between file transport and other applications. Evaluate the particular connector and operation rather than treating all FTP-family settings as SFTP behavior. Celigo documents PGP configuration in its FTP connection setup, while its SFTP connectivity page specifies RSA private keys in PEM format and says passphrase-protected SSH keys are not supported. ^{[35] [36]}

That authentication boundary affects migration. A private key accepted by another runtime may need a different supported configuration in Celigo. Boomi's current SFTP documentation, by contrast, lists password-plus-public-key authentication. Neither statement removes the need to test the actual bank policy, key format, and deployment runtime. ^[37]

Workato's SFTP connector documents host-key fingerprint configuration and support for SHA256 and MD5 fingerprint forms. Its page uses “encryption” wording for these forms; they should be understood here as fingerprint representations, not payload-encryption algorithms. ^[38] This is different from the full server public-key material requested in AWS's SFTP connector setup. Record the expected input format rather than copying a fingerprint into a key field. ^[39]

Adoption

Operational readiness depends on how the connector discovers files. Workato's new-or-updated-file trigger watches only the first directory level. An implementation expecting recursive discovery needs a different tested design. ^[40] Its initial event-start behavior also needs attention during migration because a blank field defaults to an earlier starting point. Establish the intended starting boundary before activating the recipe. ^[41]

Plan the error-data lifecycle before go-live. Celigo documents retry data for the latest 20,000 errors per flow step, subject to retention terms. An integration error queue should therefore not become the only long-term archive of original partner payloads or acceptance evidence. ^[42]

Streaming capabilities can change the preferred processing layer. Workato lists SFTP upload and download actions among streaming actions and says streaming actions do not time out based on transfer duration. That documentation is not a guarantee that a remote session, recipe, or business deadline can never fail. ^[43]

Strengths and Limitations

Retry controls are useful but narrower than business recovery. Celigo documents up to four retry attempts after the initial failure for intermittent errors when auto-resolution is enabled. An operator must still determine whether retrying an ambiguous upload can duplicate an accepted business file. ^[6] MuleSoft Partner Manager exposes reconnection-attempt configuration, including disabling retries after the initial connection failure. That setting addresses connection recovery, not proof of downstream acceptance. ^[44]

Post-read actions also deserve scrutiny. Boomi offers None, Move, Delete, and Rename, with deletion occurring after successful reading. Confirm which action occurs before mapping, validation, record creation, or acknowledgment matching in the complete flow. ^[18] Workato offers an option to skip missing files in its CSV trigger; classify disappearance deliberately so an unexpected missing source does not quietly become normal operation. ^[45]

Choose iPaaS when the team can operate its connection settings, flow definitions, retry data, and retention policy as a single supported process. Require a demonstration using the actual failure scenarios, not only a successful sample transfer.

External Managed Transfer Layer

Capabilities

An external layer can own the receiving endpoint, durable storage, network routing, and file workflow independently of NetSuite's execution. It adds another system to operate, but it can address requirements that should not be weakened to fit a direct connection.

Distinguish an SFTP server endpoint from an outbound SFTP connector. AWS documents private and internet-facing Transfer Family server endpoints separately from connectors that send or retrieve files against remote servers. Inbound Elastic IP configuration is not evidence of outbound source-address behavior. ^[46] AWS's connector documentation explicitly describes service-managed static egress and customer-controlled NAT gateways and Elastic IPs for the applicable network configuration. ^[47]

Files.com similarly documents dedicated addresses for supported outbound Remote Server connections and explains that every relevant listed address may originate a connection. A bank must approve the complete source-address set for the chosen routing arrangement. ^{[9] [48]}

Adoption

An external design needs explicit NetSuite boundaries: where NetSuite deposits or retrieves the file, which component owns encryption, which store retains the authoritative copy, and which service reports the acknowledgment. AWS SFTP connectors operate between S3 and remote SFTP servers; that documentation alone does not define a complete NetSuite integration. ^[2]

Google's connector configuration illustrates another handoff detail: its Upload action takes file contents rather than directly uploading a local file, with binary data requiring the documented encoding. Confirm how the integration supplies those contents and whether the representation fits the selected processing layer. ^[49]

Identity and routing changes belong in the recovery plan. Google warns that changing from static to automatic egress and back does not preserve the original static address set. A networking recovery step can therefore require renewed bank allowlisting before file transfer resumes. ^[50] Files.com also conditions effectively static addresses on configuration choices such as the custom domain and primary storage region. ^[51]

Strengths and Limitations

Managed workflows can separate cryptography and storage actions from NetSuite. AWS offers built-in PGP decryption for uploaded files and supports custom processing steps. Assign these operations explicitly; a workflow's decryption success is not equivalent to a business acknowledgment. ^{[52] [53]}

Object-storage SFTP endpoints also have their own filesystem semantics. Azure documents that rename fails when the target filename already exists. A staging-and-rename strategy must test the actual server's behavior rather than assuming POSIX-style replacement. ^[54] Azure additionally restricts random writes and appends through other protocols to blobs created through SFTP, while permitting full overwrites. That matters if another application edits the same object. ^[55]

Commercial evaluation should include endpoint enablement and storage, not only transfer volume. Microsoft documents hourly SFTP charges while the feature is enabled, even with no connected user, plus ordinary storage-related charges. Files.com's dedicated-address capabilities are documented for its Power and Enterprise plans. Neither source establishes a universal monthly price for this architecture. ^{[56] [57]}

Feature Comparison

The primary choice is where controls and recovery live. Table 1 summarizes fit and ownership. Its recommendations are architectural judgments based on the documented capabilities above; the implementation-service row describes who can deliver and support a selected design.

The table should not be read as a maturity ranking. A simple Connector deployment with clear ownership can be appropriate; a complex external platform with undocumented handoffs can still leave the recovery question unanswered. The service option is complementary to Oracle NetSuite and the selected transport architecture.

Host Keys and Credential Lifecycle

Maintain separate records for server identity, client authentication, and payload encryption. SSH's server authentication verifies the remote host; OpenPGP protects file contents and supports digital signatures. They solve different parts of the exchange. ^{[59] [11]}

A recommended key and fingerprint register should include:

• Endpoint: Environment, hostname, port, owner, and bank or partner contact.
• Server identity: Key type, full public-key material where required, fingerprint representation, and verification channel. ^[29]
• Client identity: Username, private-key or secret reference, permitted directories, and effective runtime permissions.
• Payload identity: Recipient encryption key, sender signing key, key identifiers, and applicable expiry or cryptoperiod. ^[31]
• Routing: Approved outbound address set and the change process for that set. ^[8]
• Recovery: Replacement, revocation, rollback, and protected backup responsibilities. ^{[60] [61]}

For a host-key rotation, obtain the replacement through the authenticated partner channel, compare fingerprints, change the trusted material in the relevant environment, and test both the expected success and rejection of untrusted material. A fresh scan alone does not establish authenticity. ^[10]

For a client-key rotation, agree the partner's overlap procedure, deploy the replacement credential, test the connection and permissions, switch the active reference, and remove the retiring authorization after the agreed acceptance criteria are met. Azure's support for multiple public keys per local user illustrates a possible overlap mechanism, not a promise that every bank supports one. ^[62]

For OpenPGP rotation, preserve the ability to decrypt retained historical ciphertext according to the retention policy. GnuPG documents export-backup data needed to restore keys and separately explains that a revocation certificate must be applied to revoke a key. ^{[61] [63]}

Performance and Benchmarks

There is no comparable cross-option benchmark established by this research. The cited material describes limits and controls, not measured NetSuite-to-bank throughput under identical conditions. Product limits should therefore be used as design constraints; the acceptance test should supply the performance evidence.

File State, Naming, and Idempotency

Idempotency means that repeating the same logical operation does not produce another business effect. This report recommends a durable file register rather than claiming an exactly-once guarantee from SFTP. A read, a successful upload, and a moved file are different events; Boomi's post-read behavior makes that boundary explicit. ^[18]

Table 2 proposes the operating state machine. These states are a design recommendation, not native status names shared by the products.

The operating advantage is that every ambiguous transition has an owner. The archive must contain sufficient evidence to restore the exchange's last accepted state, consistent with the agreed recovery point objective. ^[13] A local file lock can help serialize work, but it does not prevent an independent external process from acting on the same remote file. ^[32]

Use a filename pattern such as ENV_PARTNER_FLOW_BUSINESSDATE_LOGICALID_VERSION.ext as a documented convention, adapting it to the partner's naming rules. Keep the attempt identifier in the register unless the partner explicitly requires it in the filename. Calculate a digest of the payload and record separately whether it describes plaintext or ciphertext. Encryption can change the resulting bytes without changing the underlying business file; OpenPGP uses fresh session-key material for encrypted objects. ^[64]

Scheduling, Cutoff, and Error Classification

Work backward from the partner's cutoff: preparation, encryption, queueing, transfer, acknowledgment, and the permitted correction window all consume time. Measure elapsed time for each transition and distinguish the transport deadline from the business deadline. Define recovery time objective (RTO) and recovery point objective (RPO) with the business owner rather than inserting invented targets. ^{[12] [13]}

The runbook should classify failures before it retries:

• Identity mismatch: Verify the expected server key through the independent channel; do not approve a newly observed key automatically. ^[10]
• Authentication or permission: Check the deployed credential, allowed user, path, and operation, using the actual runtime.
• Transient connection failure: Retry within the documented policy and the remaining cutoff window. ^[44]
• Ambiguous upload: Check remote evidence and partner acknowledgment before resending the same logical file.
• Payload rejection: Quarantine and use the agreed corrected-file procedure.
• Discovery discrepancy: Inspect the watched directory scope and source-file movement, including missing-file behavior. ^{[40] [45]}

Monitor overdue states, not just failed jobs. A successful job can still leave a file waiting for acknowledgment. A failed job can still have delivered a file. The durable manifest is the bridge between those observations.

Data Analysis and Evidence

The strongest quantitative evidence available here is the vendors' documented limits. It is not a market-demand estimate, an independent speed test, or a service-level commitment. Table 3 lists distinct constraints; MB, GB, and GiB retain the units used by their sources.

The figures operate at different layers. Raising a receiving endpoint's capacity does not remove a sender's file, memory, or execution constraints. Workato's streaming documentation supplies a reason to evaluate streaming operations for large payloads, but its transfer behavior should not be substituted for NetSuite's behavior. ^[43]

Governance Calculation and Queue Capacity (Hypothetical Example)

Using Oracle's 100-unit cost per upload or download and 10,000-unit scheduled-script budget gives 10,000 / 100 = 100 theoretical transfer calls, assuming no other unit consumption. ^{[68] [69]} This is an arithmetic upper bound, not a recommended batch size or measured throughput; record updates, searches, errors, and time constraints reduce usable capacity.

External queues need the same treatment. AWS publishes a 1,000-request pending queue and acceptance of up to 100 file paths per second. Those are connector limits, not evidence that the bank can process that traffic or that a queued request meets the business cutoff. ^[70] Workato separately documents a transfer buffer maximum of 327680 bytes, reinforcing that a buffering parameter is not a total-file-size limit. ^[71]

Evidence to Collect in the Acceptance Test

No live NetSuite account test was performed for this report. The documentation review supports a reproducible test plan, not certification of a specific account. Capture:

• Account context: Production or sandbox, enabled features, installed SuiteApp version, and test date.
• Execution context: Role, script or flow version, channel, deployment, and schedule.
• Endpoint context: Host, port, environment, key type, verified fingerprint, and routing configuration. ^{[29] [8]}
• File evidence: Logical ID, attempt ID, bytes, digest, record count, amount totals where applicable, and recipient key.
• Timing evidence: State timestamps, acknowledgment latency, completion time, and cutoff outcome.
• Recovery evidence: Tested RTO and restored recovery point, compared with the agreed objectives. ^{[12] [13]}

Oracle permits scheduled deployment times every 15 minutes, but those times govern submission rather than guaranteeing execution then. Allow for queue delay when planning the cutoff. ^[72]

Test the smallest practical sample, a representative sample, and a near-boundary sample. Include missing permissions, filename collision, interrupted transfer, key change, and delayed acknowledgment. Azure's documented rename restriction is a concrete reason to include a same-name destination test. ^[54]

Implications and Future Directions

The practical NetSuite SFTP integration best practices are to define evidence and ownership before implementation. Select the option that can satisfy the endpoint's authentication, routing, payload, retention, and recovery requirements with an operating team capable of supporting it.

Rotation and Disaster-Recovery Test

A recommended rotation and recovery exercise should include:

• Inventory: Compare the live endpoint and credential inventory with the controlled register. Machine-readable key listings can support a repeatable inventory process. ^[73]
• Replacement: Verify the new host key independently or confirm installation of the new client public key. ^[10]
• Deployment: Update only the intended environment and capture the execution identity.
• Success test: Transfer a designated test file and match the partner's acknowledgment.
• Rejection test: Confirm that an untrusted host key or retired credential is rejected in the agreed test setting.
• Restore test: Recover the payload, manifest, and required decryption material from approved backups. ^[61]
• Closure: Retire old authorization, document rollback boundaries, and compare observed recovery with the agreed RTO and RPO. ^{[60] [12] [13]}

Payload-key retirement deserves its own closure step. GnuPG explains that generating a revocation certificate alone does not revoke the key; the certificate must be applied, and the revoked key must then be distributed or published as appropriate. This OpenPGP process should not be confused with removing an SSH public key from a bank account. ^{[63] [74]}

Networking should be exercised in recovery too. Google documents that switching address modes can allocate a different static address set, while Files.com describes configuration conditions affecting its dedicated addresses. Restore the approved routing relationship as well as the application configuration. ^{[50] [51]}

A consultancy or managed-support agreement can supply implementation and operating capacity, but the deliverables must be explicit. Houseblend describes building, testing, and validating integrations; the buyer should make file-state evidence, monitoring ownership, rotation tests, and recovery acceptance part of the agreed scope. ^[58] Product behavior should be retested after relevant changes. Attribute implementation failures to the observed design, configuration, data, or execution condition unless Oracle has documented a product defect.

Frequently Asked Questions (FAQs)

NetSuite SFTP Connector vs N/sftp: which should be chosen?

Choose according to workflow fit and operating responsibility. The Connector is suited to its documented bank-file purpose; custom code is appropriate when the team can own explicit selection, state, and recovery logic. The comparison matrix identifies the questions that must be resolved before either route is accepted.

What does NetSuite SFTP host key verification require?

N/sftp requires the server key to be known before connecting and does not offer an option to disable strict checking. ^[25] Collecting a key with ssh-keyscan is insufficient to establish trust; verify it through an independent partner channel before configuring the connection. ^[10]

How should NetSuite SFTP key rotation be handled?

Separate host-key changes, client-authentication changes, and OpenPGP key changes. Verify replacement server identity independently, test the deployed credential in the actual environment, and preserve historical decryption capability according to retention policy. NIST's cryptoperiod definition helps frame the policy, but does not supply a universal rotation interval. ^[31]

What should be checked for NetSuite SFTP authentication errors?

Check the executing identity, supported credential format, installed key or secret reference, remote user, directory permissions, and server-key expectation. Do not treat host identity, login, and payload decryption as a single credential problem. SSH server authentication and OpenPGP payload protection are distinct controls. ^{[14] [11]}

How should NetSuite SFTP retry and recovery work?

Use the file's last proven state and the partner's evidence. Automatic retries can help with intermittent failures, but ambiguous uploads require outcome checks before replay. Celigo's documented retry policy is an example of transport or integration recovery behavior, not a substitute for the recipient's acceptance evidence. ^[6]

Conclusion

A NetSuite SFTP integration is complete when its operators can explain what happened to a file and recover it without guessing. Connectivity is necessary, but the architectural decision also covers server ownership, trusted identity, payload protection, naming, retention, and the evidence required to advance each state.

The Connector provides a bank-focused starting point where its folder workflow and operating model fit the partner's requirements. Custom N/sftp supports a deliberately designed process when the organization can maintain the code and its recovery controls. iPaaS offers another place to coordinate files and application steps. An external managed layer can address endpoint, routing, storage, and processing requirements, provided the NetSuite handoff remains explicit.

The strongest selection method is an acceptance test built around real boundaries: the deployed role, actual credential, exact remote folder, representative payload, cutoff, acknowledgment, and replay procedure. Keep documented limits distinct from measured throughput and business recovery objectives. Preserve source evidence for any claim that a configuration is supported, then capture account-specific results for the configuration actually used.

The recommended operating artifact is a durable manifest linking logical files, attempts, control totals, acknowledgments, and archives. Pair it with a key and fingerprint register and a tested rotation and recovery runbook. These controls make the choice reviewable and give the operating team a defined next action when a transfer is incomplete, delayed, duplicated, or uncertain.