Seedbox as Private Cloud Storage via SFTP

Your Pulsed Media seedbox is also 20 GiB of private cloud storage — encrypted file space on physical drives in Finnish datacenters PM owns outright, accessible from any device with no content scanning, no ad-targeting pipeline, and no third-party storage provider in the chain. That 20 GiB is free and permanent; paid plans scale to multi-terabyte RAID5 arrays. This guide explains how to connect via SFTP, which clients work best, and why a Finnish server under EU jurisdiction handles private storage differently than a US cloud service with a behavioural advertising division. Pulsed Media has run this infrastructure since 2009, owning both the hardware and the buildings it sits in.

What SFTP Is

SFTP stands for SSH File Transfer Protocol, a subsystem that runs entirely inside an encrypted SSH session on port 22. The "FTP" in the name misleads people because it echoes the older File Transfer Protocol from 1971, but the two have nothing in common beyond the acronym — SFTP inherited no architecture from plain FTP, which sends everything in cleartext unless you force FTPS with SSL/TLS on both ends. In SFTP, encryption happens by design: the entire session, from login credentials to file contents, filenames, and directory listings, travels encrypted over that single port 22 connection, with no separate data channel to secure and no option for cleartext fallback.

Picture what happens during a transfer: you drag a video file from your desktop to the seedbox panel in your SFTP client. That file gets broken into packets, each one encrypted with session keys negotiated at connection time using algorithms like AES-256-CTR or ChaCha20-Poly1305, depending on what the server supports. An eavesdropper on your home WiFi, your ISP's backbone, or any transit router between you and Finland captures only a stream of random-looking bytes on port 22 — no readable filenames, no file contents, no hint of directory structure. This end-to-end encryption holds for every operation: uploads, downloads, deletes, renames. Even the protocol's stat command, which fetches file sizes and timestamps, runs encrypted.

Pulsed Media seedboxes provide SFTP access on port 22, managed by PMSS (Pulsed Media Seedbox Software). Users connect with the hostname and credentials from their PM client area — no extra ports to open, no firewall configuration required. The protocol supports the operations you expect from a file manager: browsing directories, uploading and downloading, creating folders, renaming and deleting files.

Unlike continuous-sync services that run a background agent watching your local folders, SFTP demands an explicit connection each time — open the client, enter credentials (or click a saved site), transfer what you need, disconnect. That control matters: nothing uploads without your say-so, no surprise battery drain from idle syncing. For automation, pair it with rclone's SFTP backend, which adds sync and mount behaviors without proprietary software. SFTP's maturity shows in its native support everywhere — every desktop OS bundles an sftp binary, every major client implements it fully, and server admins have tuned it for decades.

The security edge over FTPS comes down to simplicity: FTPS juggles control and data channels, often tripping over NAT routers and firewalls, while SFTP's single encrypted tunnel avoids all that. On PM servers, SFTP access is chrooted to your home directory, so even if credentials leak, an attacker sees only your files, not system paths. Parallel transfers in clients like FileZilla chunk large files into resumable pieces, picking up mid-transfer if your connection drops.

Why Not Google Drive or Dropbox

Consumer cloud storage starts with real appeal: apps preinstalled, drag-and-drop web interfaces, free tiers to hook you. Dig into the mechanics, though, and the problems stack up — from active content scanning tied to business models, to breach histories that expose credentials at scale, to US legal frameworks that reach data worldwide. Pulsed Media seedboxes sidestep these by design: direct hardware ownership, no ad revenue needing your file data, Finnish/EU law without FISA-style backdoors.

The scanning question

Google Drive sits inside a company where 80% of revenue flows from ads, built on behavioral signals scraped from every service. Terms allow using content to "improve products," and while Drive scanning for ads draws denials, the 2023 policy shift to check for child abuse material showed the infrastructure exists — automated analysis of stored files, triggered by hashes or heuristics. That capability doesn't vanish when not aimed at CSAM; it's the same ML pipelines that could pivot elsewhere. PM makes money on subscriptions for compute and bandwidth — file contents add zero to the bottom line, so no pipeline ingests them, no hashing runs in the background, no metadata feeds an ad engine.

Dropbox skips the ad model but carries breach baggage. Hackers grabbed 68 million credentials in 2012, details emerging publicly in 2016 after a dark web dump. 2022 brought another incident: attackers hit employee creds, then source repos. These aren't freak events — centralizing logins for hundreds of millions turns the credential store into a prize. PM spreads users across dedicated servers; no mega-database of every password waits for compromise. Each seedbox runs its own Linux user account, isolated by the kernel.

Jurisdiction: Finland versus the United States

US giants like Google, Dropbox, Microsoft OneDrive, and Apple iCloud answer to FISA Section 702. That law lets agencies task US providers with handing over non-US persons' data — no warrant, secret orders, FISA Court oversight without public appeals. Your files in a US datacenter in Ireland? Still 702-eligible if the company is US-based. PRISM scooped email and cloud data pre-Snowden; reauthorization in 2024 kept the framework intact.

Finland operates under GDPR and national law. PM must justify every data touch — storage fulfills a contract, nothing more. EU users claim access, deletion rights; breaches trigger 72-hour notifications. No Finnish statute mirrors 702 for bulk pulls without judicial review. Foreign requests route through MLAT, hitting Finnish courts first — slower, documented, GDPR-bound. PM's files never touch US soil or subprocessors.

iCloud and end-to-end encryption

Apple pushes Advanced Data Protection for E2E on iCloud Drive and backups, but it's opt-in, off by default, and skips Mail, Contacts, Calendar. Even E2E bits sit under US law — Apple complies with orders on metadata or unencrypted categories. PM's SFTP encryption happens client-side before transit, with files on owned Finnish drives — no Apple keys, no US handover risk.

The SFTP difference in storage model

Consumer cloud services shard your data across providers, countries, and CDN layers. Custody dilutes through subcontractors you never vetted and cannot audit. A PM seedbox writes your files to enterprise drives in PM-owned racks, in PM-owned buildings, on PM's own network (AS203003). The custody chain has one link: you and PM.

The practical tradeoff

SFTP means installing a client. FileZilla takes five minutes to set up; after that, connecting is one click from the saved site. PM's permanent free tier gives 20 GiB of storage with no credit card required, which is ten times what Dropbox offers on its free plan, and PM's storage is not shared with an email or photos quota. Paid plans scale to multi-terabyte RAID5 arrays on 1Gbps or 10Gbps connections. For users who want private file storage under Finnish jurisdiction without running a home server, a PM seedbox with SFTP is the simplest path to get there.

Recommended SFTP Clients

FileZilla, WinSCP, and Cyberduck handle 99% of needs — all free, open source where noted, no accounts or phoning home. Pick by OS and interface feel: dual-pane for power users, single-pane for Finder/Explorer fans.

FileZilla

FileZilla has shipped since 2001, GPL-licensed, available on Windows, macOS, and Linux. The dual-pane design puts local files on the left and remote files on the right, with a transfer queue below. Drag files between panels to transfer, or double-click to download or upload.

Download FileZilla Client from filezilla-project.org (ignore the Server download, which is a different product). In Site Manager (File → Site Manager), set Protocol to SFTP - SSH File Transfer Protocol explicitly. Selecting plain FTP instead will try port 21 and fail. For file storage use, set Transfer → Transfer Type → Binary to prevent line-ending conversion on archives, videos, and other binary files.

WinSCP

WinSCP is Windows-only and GPL-licensed. It offers both an Explorer-style single-pane view and a Commander dual-pane layout. If you already use PuTTY for SSH, WinSCP integrates with Pageant for key management, so the same keys work for both SSH and SFTP. Download from winscp.net.

WinSCP also has a scripting interface (winscp.com) that works with Windows Task Scheduler for automated backup jobs.

Cyberduck

Cyberduck runs on Windows and macOS with a single-pane remote browser. Drag files from Finder or Explorer into the Cyberduck window to upload. Credentials are stored in the system keychain (macOS) or Credential Manager (Windows), which is more secure than clients that store passwords in plaintext config files. Free from cyberduck.io.

Cyberduck supports SFTP alongside S3, WebDAV, and other protocols in a single application. Its bookmark system provides one-click reconnection to saved servers.

Connecting to Your Seedbox

Your connection details are in the Pulsed Media client area. Log in and navigate to your seedbox service details to find the hostname (format: servername.pulsedmedia.com), port (22), username, and password. Important: your seedbox username and password are different from your PM client area login credentials. This is the most common source of authentication failures. Copy the seedbox credentials exactly from the service details page.

On first connection, your SFTP client will display the server's host key fingerprint and ask you to accept it. This fingerprint uniquely identifies the server. Accept it and allow the client to cache it for future connections. If the fingerprint changes unexpectedly on a later connection, see the Troubleshooting section below.

FileZilla Connection

Step 1. Open FileZilla. Go to File → Site Manager (or press Ctrl+S / Cmd+S).

Step 2. Click "New Site" and give it a name (for example: "PM Seedbox").

Step 3. Fill in the General tab:

Protocol:    SFTP - SSH File Transfer Protocol
Host:        servername.pulsedmedia.com
Port:        22
Logon Type:  Normal
User:        your_seedbox_username
Password:    your_seedbox_password

Replace servername with the actual server name from your PM client area. Leave the Port blank if you want FileZilla to use the SFTP default (22) — or enter 22 explicitly. Either works.

Step 4. Click Connect. FileZilla will open the connection.

Step 5 — Host key verification. On the first connection to a server, FileZilla displays a dialog asking you to verify the server's host key fingerprint. This is normal SFTP behaviour. The fingerprint identifies the specific server you are connecting to. If this is your first connection: verify the fingerprint matches what the PM client area shows (if PM displays it), then click OK and optionally check "Always trust this host" to suppress the prompt on future connections. If you have connected before and see an unexpected host key change warning, see the Troubleshooting section.

Step 6. After accepting the host key, your home directory appears in the right panel. You can now browse, upload (drag from left panel to right), and download (drag from right panel to left).

Tip — Transfer Mode: FileZilla defaults to Auto transfer mode, which attempts to detect binary vs text files. For file storage purposes (photos, archives, video, documents), always use Binary mode to prevent any character conversion. Set this in Transfer → Transfer Type → Binary.

Once set, reconnects are one-click from Site Manager. Queue multiple transfers — it parallelizes up to eight by default, balancing speed.

WinSCP Connection

Step 1. Open WinSCP. The Login dialog opens automatically on launch (or go to Session → New Session).

Step 2. Fill in the Session fields:

File protocol:   SFTP
Host name:       servername.pulsedmedia.com
Port number:     22
User name:       your_seedbox_username
Password:        your_seedbox_password

Step 3. Click Save (optional but recommended) to save this connection profile for future use. Give the session a name when prompted.

Step 4. Click Login. WinSCP connects to the server.

Step 5 — Host key. As with FileZilla, WinSCP shows a host key verification dialog on first connection. Accept the key and optionally instruct WinSCP to remember it.

Step 6. Your seedbox home directory appears. In Commander mode, local files are on the left, remote files on the right. Drag files between panels to transfer.

WinSCP scripting. WinSCP includes a scripting interface (winscp.com /script=scriptfile.txt) for automating transfers from the Windows command line or Task Scheduler. This is useful for scheduled backup jobs without installing rclone.

Cyberduck Connection

Step 1. Open Cyberduck. Click "Open Connection" in the toolbar (or File → Open Connection).

Step 2. In the connection dialog:

Protocol:   SFTP (SSH File Transfer Protocol)
Server:     servername.pulsedmedia.com
Port:       22
Username:   your_seedbox_username
Password:   your_seedbox_password

Step 3. Check "Add to Keychain" (macOS) or "Save Password" (Windows) if you want credentials stored securely for reuse.

Step 4. Click Connect.

Step 5 — Host key. Accept the host key fingerprint on first connection.

Step 6. The remote filesystem opens in Cyberduck's browser. Use File → Upload to send files, or drag files from Finder/Explorer into the Cyberduck window.

Cyberduck bookmarks. Cyberduck saves connections as bookmarks (Bookmark → New Bookmark). Bookmarked connections appear in the main Cyberduck window for single-click access.

SSH Key Authentication

Password authentication works for manual use, but automation (scheduled scripts, rclone cron jobs) needs key-based authentication to avoid storing passwords in plaintext config files. SSH key authentication uses public-key cryptography: the private key stays on your device, and the matching public key on the server authorizes connections without a password.

Generating a keypair:

On Linux/macOS terminal or Windows PowerShell (OpenSSH built-in post-1809):

ssh-keygen -t ed25519 -C "pm-seedbox"

Outputs ~/.ssh/id_ed25519 (private, guard it) and .pub (public, uploadable). Windows PuTTYgen makes .ppk for WinSCP natively.

Upload .pub via password SFTP to ~/.ssh/ (create if needed). SSH in, append:

cat ~/.ssh/id_ed25519.pub >> ~/.ssh/authorized_keys
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Client tweaks:

- FileZilla: Site Manager, Logon Type "Key file", browse private key. - WinSCP: Advanced → SSH → Authentication → private key path. - Cyberduck: Connection dialog, SSH Private Key field.

Ed25519 provides 256-bit security with fast signature computation and is the default key type in modern SSH implementations. To verify the key works, reconnect to the server; if authentication succeeds without a password prompt, the key is correctly configured.

Connecting via rclone

rclone (rclone.org, MIT open source) turns SFTP into sync/mount powerhouse. Install, run rclone config, new remote, SFTP type:

host:     servername.pulsedmedia.com
user:     your_seedbox_username
port:     22
pass:     your_seedbox_password (or key_file=/path/to/private)

Name it "pm". Commands:

rclone copy /local/path pm:/remote/path      # copy local to remote
rclone sync /local/path pm:/remote/path      # sync (one-way, remote mirrors local)
rclone ls pm:/                               # list remote files
rclone mount pm:/ /mnt/seedbox               # mount as local drive (Linux/macOS)

Windows needs WinFsp (winfsp.net):

rclone mount pm:/ X: --vfs-cache-mode writes

X: acts local; writes queue, flush on unmount. Cache modes: full for reads, writes for uploads. Add --transfers 4 for parallel speed.

What You Can Store and Access

Your seedbox home directory is your storage space, a plain Linux ext4 filesystem with no restrictions on file types or individual file sizes beyond your overall disk quota. You can create any directory structure you want: Photos/2024/, Backups/Work/, Projects/ClientName/. File permissions are standard Linux: your files are readable only by your user account, and other users on the same server cannot access your home directory.

SFTP supports all the operations you would expect from a file manager: uploading and downloading files, creating and removing directories, renaming and moving files, and checking file sizes and timestamps. Large file transfers are chunked and resumable, so a dropped connection on a 50 GiB transfer picks up where it left off rather than restarting from zero. PMSS enforces disk quotas on the server side; uploads stop when you reach your allocation. You can check current usage by running quota -s via SSH.

What SFTP does not do by itself: it does not synchronize directories automatically (for that, use rclone with rclone copy or rclone sync as described in the Use Cases section below), and it does not mount the seedbox as a local drive (SSHFS on Linux/macOS or rclone mount on any OS handles that). SFTP is an explicit connection model: you open the client, transfer what you need, and disconnect. For web-accessible file sharing, PM seedboxes serve files over HTTPS at https://servername.pulsedmedia.com/user-username/.

Use Cases

Seedboxes excel as private storage when local fails — drive crash, ransomware, flood. Files sit safe in Finland, untouched by home disasters. EU users keep GDPR coverage; others dodge US laws.

Offsite backup

Schedule a daily rclone sync job via cron (Linux/macOS) or Task Scheduler (Windows) and only changed files transfer each run:

rclone sync ~/Documents pm:/backups/Documents --backup-dir pm:/backups/archive

The --backup-dir flag keeps old versions of overwritten files in a separate directory rather than deleting them. M-series plans use RAID5, which tolerates one complete drive failure without data loss — your backup survives hardware events that would destroy a single-drive NAS at home. V-series uses RAID0 for maximum speed and capacity without redundancy, which suits scratch storage where the original copy lives elsewhere.

For incremental transfers over SSH, rsync works directly:

rsync -avz --progress /local/path/ username@server:/remote/path/

Only deltas transfer, and compression squeezes bandwidth on text-heavy content.

One important distinction: RAID5 protects against hardware failure (one drive can fail completely without data loss), but RAID is not a backup. It does not protect against accidental deletion, ransomware, or sync errors that propagate from your local machine. If you use rclone sync and a local file is deleted or corrupted, the next sync run deletes or overwrites the remote copy to match. The --backup-dir flag shown above mitigates this for modified files, but the safest approach is to use rclone copy (which only adds, never deletes) for irreplaceable data, or maintain a second backup destination entirely.

Private file sharing

Email attachments cap at 25 MB. WeTransfer routes files through US infrastructure. Drop a file into the web-accessible directory on your seedbox and share the direct link: https://servername.pulsedmedia.com/user-username/file.zip. The recipient downloads directly from your seedbox over HTTPS — no account creation, no tracking pixel, no "free trial expired" interstitials. PM's network (AS203003) delivers at up to 1Gbps on shared plans. When you want to stop sharing, delete the file. Access revokes immediately because there is no CDN cache holding a copy.

Media archive

RAW photos at 50MB each, 4K footage, archival collections — PM quotas handle terabytes across paid plans. No Google Photos AI scanning of your images, no content-based heuristics. Transfer speed depends on your home connection and time of day; on a quiet 1Gbps plan, retrieving a 200 GiB media archive takes roughly half an hour. Your upload speed is usually the bottleneck, not the seedbox.

Working storage for remote tasks

Upload a dataset or a batch of scripts via SFTP, SSH into the seedbox to run processing jobs (ffmpeg transcoding, data transformation, anything that runs on Linux), then pull results back via SFTP when finished. Your laptop can sleep the entire time. The seedbox runs 24/7 on RAID storage with 1Gbps or 10Gbps connectivity depending on plan, and you are not paying for compute time — the processing capacity is part of the seedbox you already have.

Cross-device access

Upload from your laptop, pull to your phone an hour later. SFTP clients exist for every platform: Termius or AndFTP on Android, Secure ShellFish on iOS (which integrates with the iOS Files app for native access). Unlike Dropbox or iCloud, there is no background sync agent draining battery or consuming mobile data. You connect when you want to, transfer what you need, and disconnect.

Finnish Jurisdiction and Privacy

Data location dictates access rules — who compels production, under what process. PM's Finnish base, EU membership, owned infrastructure stack the deck differently than US clouds.

Finland's legal framework

GDPR applies directly to Pulsed Media as an EU-based company. Every data processing operation requires a legal basis — for file storage, that basis is contract fulfilment: PM stores your files because you signed up for storage. GDPR mandates data minimization, 72-hour breach notification, and gives users rights to access and deletion. The Finnish Data Protection Ombudsman oversees compliance locally. The EU Court of Justice has struck down broad data retention directives, and Finland has no national law requiring hosting providers to log file transfer activity for surveillance purposes.

The US FISA 702 contrast

FISA Section 702 authorizes US intelligence agencies to compel US-based companies to hand over non-US persons' data — without a warrant, under secret orders, with oversight from a court that does not permit public appeals. The PRISM program operated under this authority. Reauthorization in 2024 kept the framework intact. If a foreign government wants data from a Finnish company, the request routes through MLAT (Mutual Legal Assistance Treaty), which requires Finnish court approval and GDPR compliance before anything is disclosed.

Datacenter physical sovereignty

PM owns the datacenter buildings in Lauttasaari, Helsinki (Kiviaidankatu 2, 00210, originally built by Academica and acquired from Nebula) and Kerava (built by PM). The hardware inside is PM's. There is no colocation provider in the chain — no Hetzner, no OVH, no third-party rack access. When you store files on a PM seedbox, the chain of custody is: you, then PM. One link.

No advertising model, no scanning incentive

PM's revenue comes from hosting subscriptions. There is no advertising business that would benefit from analyzing your file contents. No behavioral data pipeline, no ML training corpus extraction, no hash-matching system scanning uploads. The infrastructure exists to store and serve files, not to monetize them.

PM has operated since 2009, over 16 years under the same ownership in Finland. The Finnish national power grid (Fingrid) delivers 99.99995% uptime, with average annual interruptions under one minute per connection. Roughly 95% of Finnish electricity is fossil-free, sourced from hydro, nuclear, and wind.

Troubleshooting

Connection refused on port 22

"Connection refused" means the client reached the IP address but nothing is listening on port 22 there. The most common cause is a wrong hostname — it must be servername.pulsedmedia.com exactly as shown in your PM client area, not pulsedmedia.com by itself and not just an IP address. Also check that your SFTP client is set to SFTP protocol, not FTP — FTP tries port 21 instead. If the hostname is correct and the protocol is SFTP, check whether your local network or VPN is blocking outbound port 22; testing from a mobile data connection can rule this out.

Authentication failed

If you reach the server but authentication is rejected, the most common cause is using PM account credentials instead of seedbox credentials. Your PM client area email and password are different from your seedbox username and password — the seedbox credentials are shown on the service details page in the client area. Copy them exactly; passwords with special characters sometimes get mangled by GUI paste. If you have multiple seedbox services on different servers, verify you are matching the right hostname to the right set of credentials.

Host key changed warning

Your SFTP client cached the server's host key fingerprint on first connection. If the fingerprint changes, the client warns you. This is normal after a server migration — PM will have notified you if your seedbox moved to different hardware. In that case, accept the new key and the client will cache it going forward. If you have not received any migration notification and the warning appears unexpectedly, do not accept the new key — contact PM support first, as an unexpected key change could indicate a network interception attempt.

Transfer stalls on large files

A transfer that starts normally but stalls mid-file is usually a network congestion issue between your ISP and Finland, not a seedbox problem. Try again during off-peak hours. If your SFTP client supports buffer size adjustment, reducing it can help on high-latency connections. Using rclone with --transfers 4 runs parallel streams, which often works around single-connection bottlenecks. If transfers stall consistently across multiple days and times, open a PM support ticket with the specific transfer times and file sizes.

Cannot see previously uploaded files

If you have multiple seedbox services, each runs on a different server with its own hostname and its own isolated storage. Files uploaded to server A are not visible when connected to server B. Verify you are connecting to the correct hostname. If you are on the right server but files seem missing, check that you are in your home directory — some clients may open in a subdirectory after reconnection.

Permission denied on upload

Check your disk quota first: SSH into the seedbox and run quota -s to see used versus allocated space. If you are at your quota limit, uploads will fail until you free space or upgrade your plan. If quota is not the issue, verify you are writing to a path inside your home directory — SFTP access is chrooted to /home/username/, so attempts to write outside that path will be denied.

Slow transfer speeds

Run a speed test from your local machine first — if your home connection is 50 Mbps upload, that is the ceiling regardless of the seedbox's capacity. Try transferring at a different time of day; peak-hour congestion on transit links between your ISP and Finland can reduce throughput. FileZilla shows average speed per transfer in the queue — significant variance between transfers to the same server suggests path congestion rather than a server-side issue. Using rclone with --transfers 4 can improve total throughput by running parallel streams. If speeds are consistently low across multiple days and times, open a support ticket with specific transfer times and file sizes so PM can check for network issues on the server side.

At Pulsed Media

SFTP access comes standard on every seedbox plan — no add-on purchase, no additional configuration. V-series plans use RAID0 for maximum speed and capacity; M-series plans use RAID5, which tolerates one complete drive failure without data loss. Network connectivity is either 1Gbps shared (the "1000" suffix in plan names) or 10Gbps dedicated (the "10G" suffix).

The free tier provides 20 GiB of permanent private storage with 200 GiB/month traffic and 125 MB RAM — no credit card required, no time limit, full SFTP access. It is available at pulsedmedia.com/free-seedbox.php. Paid plans scale from hundreds of gigabytes to multi-terabyte RAID5 arrays.

PMSS, the open-source management software, handles user accounts, disk quotas, SFTP access, and per-user service monitoring. PM operates its own autonomous system (AS203003) and owns the datacenter buildings where all hardware runs — Lauttasaari in Helsinki, where the sea fiber to Stockholm terminates, and Kerava outside Helsinki.

Private file storage on physical Finnish hardware, accessible with any SFTP client, from 20 GiB free to multi-terabyte paid plans. For encrypted traffic tunneling through your seedbox, add WireGuard VPN — also included on all plans at no extra cost.