Once your EDI documents are formatted, they need a secure and reliable way to travel between you and your trading partners. This isn't like sending a regular email. EDI transactions are business-critical, often containing sensitive financial data. The transport method must guarantee not just delivery, but also security, integrity, and proof of receipt.

Two protocols dominate this space: AS2 and SFTP. While both securely transfer files, they operate on fundamentally different principles and offer distinct advantages. Choosing the right one depends on your partner's requirements, your technical capabilities, and the level of legal assurance you need.

Applicability Statement 2, or AS2, was designed specifically for business-to-business messaging. It works by packaging EDI data and sending it over the internet using HTTP or HTTPS, the same protocols your browser uses to load websites. But AS2 adds crucial layers of security on top.

Each message is encrypted using the recipient's public key and digitally signed with the sender's private key. This process uses a standard called S/MIME (Secure/Multipurpose Internet Mail Extensions). This ensures that only the intended recipient can read the message (confidentiality) and that the message genuinely came from the sender and wasn't altered in transit (authenticity and integrity).

The defining feature of AS2 is the Message Disposition Notification, or MDN. This is an automated, cryptographically signed receipt. When the recipient's server receives and successfully decrypts the AS2 message, it sends back an MDN. This receipt is more than just a delivery confirmation; it provides legally binding proof that the complete, unaltered message was received. This concept is known as non-repudiation—the sender has undeniable proof of delivery, and the recipient cannot later claim the message never arrived or was corrupted.

SFTP stands for SSH File Transfer Protocol. Unlike AS2, it wasn't designed for EDI but as a general-purpose, secure way to transfer files. It operates as a subsystem of SSH (Secure Shell), the same technology system administrators use to securely log into remote servers.

SFTP's approach is simpler. It creates an encrypted tunnel between the client and the server. All data, including authentication credentials and the files themselves, passes through this single secure channel. Authentication is typically handled using a username and password or, more securely, with SSH public/private key pairs. The client presents its public key to the server, which verifies it against a list of authorized keys.

While highly secure, SFTP provides no built-in mechanism for non-repudiation. It can confirm that a file was successfully uploaded to a folder, but it doesn't offer a signed, legally binding receipt like an AS2 MDN. It's like putting a letter in a locked mailbox—you know you put it there, but you don't have a signed receipt from the recipient confirming they opened and read it.

The decision between AS2 and SFTP often comes down to a trade-off between features and complexity.

AS2 is the preferred standard in industries like retail and healthcare where proof of receipt is a strict business or legal requirement. The overhead of managing X.509 certificates—which are issued by trusted Certificate Authorities and require periodic renewal—is justified by the need for non-repudiation.

SFTP is often chosen for its simplicity and efficiency, especially for large, batch file transfers. If your trading partners operate on a mailbox model (dropping files in a folder for you to pick up) and don't require MDNs, SFTP is a robust and straightforward solution. Managing SSH keys is generally less complex than managing a full Public Key Infrastructure (PKI).

Ultimately, both AS2 and SFTP are highly secure protocols. The best choice depends on finding the right balance between the technical capabilities of you and your partners and the business requirements for your data exchange.