PGP Encryption Software — Built into Diplomat MFT
How to Automate File Transfer Using PGP & SFTP
Secure financial statements with trading partners, data lake & cloud computing integration. With many protocols available, Diplomat MFT can move just about any file anywhere.
Applications Engineer · G2 Verified Review
★★★★★
Send Files to Anywhere From Anywhere
Our customers rely on us to integrate and work with their existing healthcare, accounting, HR, financial, and other business software solutions for their secure file transfer needs. Book a personalized demo or get a quote from one of our MFT experts today!
PGP Web
Interface
Threat Intelligence & IP Protection
SFTP Connections Reporting
PGP Enforcement Rules
Enhanced Integration & Automation
PGP Encryption Explained
What is PGP Encryption?
PGP (Pretty Good Privacy) is a data encryption standard that uses a combination of symmetric-key and public-key cryptography to protect files before they are transmitted or stored. Invented by Phil Zimmermann in 1991, it has become the default encryption standard for B2B file transfer in healthcare, financial services, logistics, and any environment where sensitive data crosses organizational boundaries.
The mechanism is straightforward in principle: each participant holds two mathematically linked keys. A public key, shared openly, encrypts the file. A private key, kept secret, is the only thing that can decrypt it. Even if an encrypted file is intercepted in transit, it is mathematically unreadable without the matching private key.
PGP encryption matters for regulated industries because it provides application-layer protection that operates independently of the transport channel. Unlike SFTP, which secures the connection, PGP secures the file itself, before upload, during transit, and at rest on the destination server.
Public key
Private key
Kept secret on your server. Only this key can decrypt files encrypted with your public key.
Key pair rotation
Keys expire every 1–2 years. Manual key management means repeating the exchange process with every partner, every time.
File stays encrypted at rest
A PGP-encrypted file (.pgp) cannot be opened by anyone — including server administrators — without the private key.
Where PGP is mandated in practice:
The Security Rule requires covered entities and business associates to protect PHI during transmission. PGP is the accepted technical safeguard for file-based PHI exchanges between healthcare organizations and their trading partners.
Organizations handling payroll, trading data, and customer records — including banks, insurers, and fintech platforms — routinely mandate PGP for inbound data from third-party providers.
PGP has become the de facto standard for encrypted EDI because it works across heterogeneous environments. Your trading partner does not need to run the same software stack as you.
Understanding the Layers
Why PGP and SFTP work together and why you need both
A common misconception is that SFTP and PGP are alternatives — that using one means you do not need the other. In practice, they protect different things and work at different layers. For true end-to-end security, you need both.
SFTP — secures the channel
SFTP (SSH File Transfer Protocol) encrypts the connection between sender and receiver. It protects data in transit from network-level interception, man-in-the-middle attacks, and credential sniffing.
What SFTP protects against: intercepted network traffic, sniffed credentials, unencrypted FTP exposure.
What SFTP does not protect: the file itself. If your SFTP server credentials are compromised, or if someone with legitimate server access should not be reading a particular file, SFTP alone offers no protection. The file on the server is readable by anyone with access to the filesystem.
PGP — secures the file
PGP encryption operates at the application layer, independently of the transport protocol. A PGP-encrypted file is encrypted before upload, encrypted during transit, and encrypted at rest on the server until the recipient decrypts it with their private key.
What PGP protects against: server compromise, insider threats, compliance audit failures, unauthorised access to stored files.
What PGP does not protect: the network channel itself. Without SFTP, the encrypted file still travels over an unprotected connection — exposing you to interception attacks even if the payload is encrypted.
Used together, they provide defence in depth: the transport is encrypted (SFTP), and the file payload is encrypted (PGP). This combination is the standard approach in healthcare IT, financial services, and any regulated environment where data must be protected end-to-end — in transit and at rest. Diplomat MFT natively combines both, automating PGP at the point of upload so you do not have to choose between security and simplicity.
Worked example: a payroll file moving from a payroll bureau to a healthcare network
A payroll bureau needs to deliver weekly payroll files containing employee bank details and salary data to a regional hospital network. The hospital's IT policy requires both SFTP transport and PGP encryption. Here is what happens at each stage and what each layer actually protects.
File preparation
The payroll bureau's system generates payroll_week22.csv. Before any transfer begins, Diplomat MFT PGP-encrypts the file using the hospital network's public key, producing payroll_week22.csv.pgp. At this point, the file is already unreadable to anyone without the hospital's private key — including the payroll bureau's own staff.
Transmission over SFTP
Diplomat MFT opens an outbound SFTP connection to the hospital's Diplomat Edge Gateway. The SSH handshake establishes an encrypted tunnel. The .pgp file travels through this tunnel — so the payload is doubly protected: the SFTP layer encrypts the transmission, and the PGP layer encrypts the file content within it.
Arrival and storage
The file lands in the hospital's designated inbound folder as payroll_week22.csv.pgp. It remains encrypted on disk. A server administrator browsing the filesystem sees only the .pgp file — they cannot open or read it without the private key, which is held separately under access controls.
Decryption by the authorised recipient
The hospital's payroll system, which holds the private key, decrypts the file automatically as part of its workflow. The plaintext CSV is made available only to the authorised internal process, only at the point of use.
What each layer contributed: SFTP ensured the file could not be intercepted on the network during transmission. PGP ensured that even if someone gained access to the SFTP server, the file storage, or the transmission logs, they could read nothing without the private key. Neither layer alone is sufficient — SFTP without PGP leaves files readable on the server; PGP without SFTP leaves the transmission channel unprotected.
With Diplomat MFT, both layers are active by default. Neither the payroll bureau nor the hospital's IT team needs to configure, verify, or manually apply them on each transfer.
The Manual PGP Problem
What manual PGP encryption actually looks like for your trading partners
Before a smaller trading partner (an independent clinic, a regional supplier, a small financial firm) can send you a single PGP-encrypted file the traditional way, they face a gauntlet of technical steps that most non-IT users have never encountered. The result is predictable: partners make mistakes, skip steps, or abandon PGP entirely and resort to unencrypted email to meet their deadlines. Your compliance posture suffers because the process is simply too hard for the people in your supply chain.
The comparison below shows the reality. 14 steps with Kleopatra and FileZilla. Three steps with Diplomat MFT 9.5.
PGP Encryption: Rigmarole vs. Simplicity
What it actually takes for an external partner to send you PGP-encrypted files. The old way versus the new way.
The Old Way
Kleopatra + FileZilla + Hope
Diplomat MFT 9.5
Web Transfer Portal + Automatic PGP
or an encryption option.
What Diplomat MFT Handles Automatically — invisible to the external partner
The Shopping Cart Abandonment Problem
Just like e-commerce loses customers at a complex checkout, organizations lose compliance when PGP is hard. Partners skip it, make mistakes, or generate support tickets. Diplomat MFT 9.5 removes the checkout friction from your information supply chain.
The old way requires 14+ manual steps across 3 applications, plus ongoing key expiry maintenance. Diplomat MFT 9.5 reduces this to 3 steps in a browser. No software. Encryption enforced automatically by policy.
With Diplomat MFT 9.5
How to automate file transfer using PGP — 3 steps, any browser
With Diplomat MFT 9.5, you can enforce PGP encryption across your entire information supply chain without asking trading partners to install anything, learn anything, or do anything differently from a standard file upload. PGP is applied automatically by policy at the moment of upload — the partner experience is identical to uploading a file to Dropbox.
Unified Security
Enterprise-grade security built into every transfer. Web Transfer Portal, Threat Intelligence, and IP Access Controls work together to protect your entire data supply chain without heavyweight infrastructure.
Web Transfer PORTAL
Browser-Based Secure File Exchange (No Client Install Required)
Empower internal teams and external trading partners with a secure, browser-based file transfer portal. Because PGP enforcement and audit visibility are built in from the start, there is no software to install and no added complexity.
No agent install: Partners connect securely via browser using existing SFTP/FTPS credentials
Branded portal: Customisable interface for a professional B2B partner experience
PGP enforcement: Automatically apply encryption policy to all browser-based uploads
Full audit trail: Every session, file, and action logged and timestamped for compliance
Threat Intelligence
Proactive Threat Detection at the Transfer Layer
Diplomat MFT automatically blocks connections from known malicious IP ranges before any data exchange occurs. Live threat feeds update continuously ensuring your environment stays protected without manual intervention.
Real-time threat feeds: Live IP reputation data blocks risky connections at the transfer layer automatically
Partner security scoring: Assess and score SFTP partner posture across your ecosystem
Zero manual overhead: Threat database updates run silently in the background
Audit-ready logs: Every blocked attempt recorded with full timestamp and context
IP Access Rules
Granular Network Access Control. Zero Trust at the Transfer Layer.
Define precise allow/deny rules at the IP, CIDR range, or hostname level. Enforce Zero Trust principles at the transfer perimeter so only permitted sources can initiate or receive transfers.
Allow/deny lists: Whitelist partner IPs and block all other inbound connections
CIDR range support: Apply policies to full network ranges with a single rule entry
Per-user policies: Apply different access rules by user account or group
Full visibility: All allowed and blocked attempts logged in real time for audit
New in Diplomat MFT v9.5
Automatic PGP policy enforcement | architecture overview
Diplomat MFT’s security architecture places the Diplomat Edge Gateway in the DMZ as a reverse proxy that accepts inbound transfers from browsers, SFTP clients, and cloud storage endpoints, without storing credentials or files in the DMZ itself. All files and credentials remain in the trusted network. No inbound holes are required in your internal firewall.
The automatic PGP policy enforcement layer (new in v9.5) operates at the point of browser upload. When a partner drags a file into the Web Transfer Portal, the file is PGP-encrypted inside their browser before transmission begins. The policy is enforced server-side; the partner cannot bypass it, forget it, or configure it incorrectly.
Real-World Scenario
Closing the HIPAA gap: when manual PGP fails your medical supply chain
Sarah is the IT Director for a regional healthcare network. To maintain HIPAA compliance, she needs daily patient records from 50 small, independent clinics. Most have no dedicated IT staff — just overworked office managers.
✖ The manual PGP approach
Sarah mandates PGP using Kleopatra and sends a 10-page instruction manual to each clinic. Within days, her support queue fills up.
- Clinic managers are confused by key pair wizards and the difference between public and private keys
- Sarah’s team spends hours each week troubleshooting software installations and lost passphrases
- Five clinics start sending unencrypted files via standard email just to save time
- Sarah now has active HIPAA security gaps in her information supply chain — the exact outcome she was trying to prevent
The breaking point: security depends entirely on non-technical users doing it correctly, every time. They don’t.
✔ With Diplomat MFT 9.5
Sarah switches to Diplomat MFT 9.5 and enables the Web Transfer Portal with a single checkbox. She emails each clinic a URL.
- A clinic nurse opens her browser, drags a patient record into the upload window, and clicks upload
- Behind the scenes, Diplomat MFT automatically PGP-encrypts the file inside the browser — before it leaves the clinic’s network
- The file lands encrypted at rest on Sarah’s server, with a full audit trail of who uploaded what and when
- End-to-end HIPAA encryption across all 50 clinics — achieved overnight
Zero support calls. No software installs. The clinics don’t even know they’re performing complex encryption.
PGP Encryption Software Comparison
Manual PGP tools vs Diplomat MFT 9.5 | side by side
Tools like Kleopatra and GPG4Win are capable PGP implementations — they work fine for technically proficient individual users. The problem is operational: when you need to enforce PGP across dozens or hundreds of trading partners with varying technical skill levels, manual tooling breaks down. This is where automated PGP encryption software changes the picture.
| Feature | Manual PGP(Kleopatra / GPG4Win) | ✔ Recommended Diplomat MFT 9.5Automated PGP |
|---|---|---|
| Software install required | Yes — GPG4Win + SFTP client | No — any browser |
| Key generation | Manual (Key Pair Wizard) | Automatic |
| Key management | Manual — export, email, import | Automatic — server-managed |
| Key expiry handling | Manual — repeat every 1–2 years | Automatic key rotation |
| Steps to send first file | 14+ | 3 |
| User skill required | Intermediate technical | None |
| Risk of user error | High — manual steps every transfer | Near zero — policy-enforced |
| Audit trail | None | Full — every session timestamped |
| Browser-based uploads | No | Yes — with automatic PGP |
| Compliance enforcement | Depends on individual user | Policy-enforced, non-bypassable |
What Diplomat MFT handles automatically invisible to the external partner
Every security operation listed below happens server-side, automatically. Your trading partners and internal users experience a standard file upload while Diplomat MFT enforces encryption, manages keys, and maintains a complete audit record in the background.
In 20+ years of production.
Choose from 3 Editions
We have three editions of Diplomat MFT to suit varying business requirements and budgets.
Tools, Calculators & Resources
Validate your investment case, benchmark your current setup, and explore how Diplomat MFT compares — before you pick up the phone.
Frequently asked questions about PGP encryption software
PGP encryption software is any tool that implements the Pretty Good Privacy standard to encrypt files, emails, or data using public-key cryptography. A public key encrypts the data; only the matching private key can decrypt it. Common tools include GPG, Kleopatra/GPG4Win, and enterprise managed file transfer platforms like Diplomat MFT that build PGP encryption directly into automated transfer workflows.
The critical distinction for enterprises is between standalone PGP tools (where users manually manage keys, encrypt files, and operate SFTP clients as separate steps) and integrated PGP encryption software like Diplomat MFT, where encryption is applied by policy automatically at the point of upload with no manual intervention from the sender.
PGP (Pretty Good Privacy) is the original encryption standard developed by Phil Zimmermann in 1991. GPG (GNU Privacy Guard) is an open-source implementation of the OpenPGP standard (RFC 4880), the open specification derived from PGP. In practice, PGP and GPG are fully interoperable: a file encrypted with GPG can be decrypted with PGP-compatible software, and vice versa.
For most business use cases the terms are interchangeable. When organizations mandate "PGP encryption," they mean the OpenPGP standard, which can be satisfied by GPG, commercial PGP products, or any compliant implementation. Diplomat MFT uses the OpenPGP standard and is fully compatible with keys generated by GPG, Kleopatra, and other PGP-compatible tools.
To decrypt a PGP-encrypted file you need the private key that corresponds to the public key used to encrypt it. In a manual workflow using tools like GPG or Kleopatra, you open the application, select the encrypted file (.pgp or .gpg), and the software decrypts it using your stored private key and passphrase.
In an automated environment like Diplomat MFT, decryption happens server-side as part of the workflow. When an encrypted file arrives, Diplomat MFT automatically decrypts it using the configured private key before routing it to its destination. No manual steps, no passphrase prompts, no user involvement.
Common reasons PGP decryption fails: the wrong private key is being used, the key has expired, the passphrase is incorrect, or the file was encrypted with a different recipient's public key. In Diplomat MFT, key management is automated so these failure modes are eliminated.
Sending a PGP-encrypted file manually using tools like Kleopatra and FileZilla involves four distinct phases, each requiring technical knowledge that most non-IT users do not have.
1. Software installation. The sender must download and install GPG4Win (which includes Kleopatra) for PGP encryption, plus a separate SFTP client such as FileZilla for the actual file transfer. Two applications, two separate installations.
2. Key generation and exchange. The sender must generate a PGP key pair in Kleopatra (choosing cipher, bit length, and expiry date), export their public key as a .asc file, email it to the recipient, download the recipient's public key, and import and certify it in Kleopatra. This exchange must be repeated with every new trading partner.
3. File encryption. For each file transfer, the sender must right-click the file, select Sign & Encrypt in Kleopatra, choose the correct recipient key from their certificate list, and select the right encryption options (sign, encrypt, ASCII armour). One wrong choice and the recipient cannot open the file.
4. File transfer. The sender opens FileZilla, enters SFTP credentials (host, port, username, and SSH key or password), accepts the host fingerprint warning, navigates to the correct remote folder, and drags the encrypted .pgp file across. That is 14+ steps in total, plus the fact that PGP keys expire every one to two years and the entire key exchange process must be repeated.
Diplomat MFT 9.5 reduces this to three steps in a browser with no software to install. PGP encryption is applied automatically by policy at the point of upload.
SFTP and PGP operate at different layers and protect different things. SFTP secures the connection between sender and receiver during transmission, protecting against network interception. PGP secures the file itself, independently of how it is transmitted, so the file remains encrypted at rest on the destination server even after the SFTP session ends.
Used together, they provide defence in depth: the transport channel is encrypted (SFTP) and the file payload is encrypted (PGP). This is the standard approach in healthcare, financial services, and regulated environments where data must be protected both in transit and at rest. Diplomat MFT natively combines both, automating PGP at the point of upload so you never have to choose between security and simplicity.
PGP automation means applying PGP encryption and decryption automatically as part of a file transfer workflow, without requiring manual steps from users. Instead of asking trading partners to install software, generate key pairs, and manually encrypt files before each transfer, PGP automation handles all of this server-side through policy enforcement.
In Diplomat MFT 9.5, PGP automation works at the browser level. When a partner uploads a file via the Web Transfer Portal, the file is automatically PGP-encrypted inside their browser before transmission begins. The partner never interacts with keys, passphrases, or encryption settings. On the receiving side, Diplomat MFT can automatically decrypt, validate, and route files as part of multi-step workflows without any manual intervention.
The business case for PGP automation is clear: manual PGP fails at scale because non-technical partners make mistakes, skip steps, or generate support overhead. Automation removes the human variable entirely.
Diplomat MFT includes the technical safeguards required by the HIPAA Security Rule for electronic PHI (ePHI) transmission and storage: end-to-end PGP encryption for files in transit and at rest, full audit logging of all file access and transfer activity, role-based access control with MFA, and SSO via SAML/LDAP for administrative access.
The Web Transfer Portal with automatic PGP enforcement is particularly relevant for healthcare supply chains that include smaller trading partners without dedicated IT resources. Instead of sending clinics a 10-page PGP setup guide, healthcare IT teams can mandate encryption across all partners with a single policy setting in Diplomat MFT.
For specific HIPAA compliance requirements in your environment, contact the Coviant team for a free discussion.