❓ FTAPI Trust Networks: FAQ on security, visibility and reporting
This article answers the questions administrators ask about automatic connections in the FTAPI Trust Network (FTN). It is written for administrators and is intended as a basis for an internal security and compliance assessment. The questions are grouped into five topics:
- Joining the network: what changes when your instance joins and what other organizations learn about you
- Authentication and protection against misuse: how instances and domains are verified and how deliveries are scanned for viruses
- Controls: what can be allowed, blocked or disabled
- Traceability and reporting: which records you keep and what the other side sees
- Data retention: what happens when a delivery is deleted
The examples in this article use two demo organizations: Beispiel AG with the instance filetransfer.beispiel-ag.de and the email domain beispiel-ag.de, and Muster GmbH with the instance secure.muster-gmbh.de and the email domain muster-gmbh.de.
Joining the network
What changes for our instance simply because it joins the network?
One thing changes even without verifying your own domain: if another FTAPI organization has verified its domain, deliveries to that organization go directly to the respective recipient on their instance. In that case, no guest account is created on your instance anymore.
Example: Muster GmbH has verified its domain muster-gmbh.de, Beispiel AG has not. When Erika Mustermann at Beispiel AG sends a delivery to max.mustermann@muster-gmbh.de, the delivery arrives directly in Max Mustermann's FTAPI account on secure.muster-gmbh.de. No guest account is created on filetransfer.beispiel-ag.de.
Which information about our organization is visible to other FTAPI organizations?
The central directory passes the following information to other FTAPI servers:
- the information that your instance is part of the network. This information is stored in the database. One note on this: cloud customers have no access to the database, only on-premise customers can check this information in the database themselves.
- for verified domains, the information that these domains belong to your instance.
On this basis, every server in the network keeps a directory of all participating organizations. This full directory is not visible in the platform interface.
As soon as data is exchanged between your organization and another FTAPI organization, that exchange becomes visible in the admin interface on both sides. What exactly the other side sees is described below under "What does the administrator of the partner organization see?".
Example: Other FTAPI servers receive the information from the central directory that filetransfer.beispiel-ag.de is part of the network. If Beispiel AG also verifies its domain beispiel-ag.de, other FTAPI servers additionally receive the information that this domain belongs to the instance filetransfer.beispiel-ag.de.
Authentication and protection against misuse
Which data flows are created by the certificate-based connection before a domain is verified?
To become part of the network, a server goes through the following process:
- The FTAPI server creates a Certificate Signing Request (CSR) and sends it to the central registry.
- Based on the server's URL, the registry verifies that this exact server issued the CSR and that it is reachable.
- On the FTAPI side, an additional check confirms that the request actually came from an FTAPI customer server.
- Only then is a certificate issued and the server added to the central registry.
How does the FTAPI Trust Network protect against impersonation?
Protection works on two levels:
| Level | Protection |
|---|---|
| Instance | The check during onboarding prevents any other server from posing as an FTAPI instance. The registry issues a certificate only once the server is reachable under its URL and confirmed as an FTAPI customer server. |
| Domain | Verification via a DNS TXT record prevents anyone from claiming a domain whose DNS management they do not control. |
Are deliveries sent through the Trust Network scanned for viruses?
Scanning depends on whether the organizations involved have a virus scanner enabled:
- on sending, if the sending organization has a virus scanner enabled,
- on receipt, if the receiving organization has a virus scanner enabled.
If an organization does not use a virus scanner, no scan takes place at that point.
Controls
Can we explicitly allow or block individual organizations?
There is no allow or block list at organization level, and the Trust Network does not change that: every FTAPI organization could already send deliveries to your employees before, back then via a guest account. The Trust Network changes the route a delivery takes, not who is allowed to send. Connections are created automatically as soon as data is exchanged for the first time.
The controls on your own instance stay the same: user management, groups, licences, permissions and the security levels of your own deliveries all apply as before.
Can we centrally disable individual Trust Network connections?
Point-to-point connections in the earlier sense no longer exist, so there is no single connection that could be switched off: all organizations in the FTAPI Trust Network can send deliveries to all other participating organizations. There was no way to block deliveries from a specific organization before either.
What is new is the transparency about it: in the Admin Panel under "Trust Network" you see the organizations you have already exchanged data with, each with the partner domain and the date of the first and the most recent exchange. How to open this overview is described in View active FTN connections in the Admin Panel.
Traceability and reporting
Do we keep our reporting if no guest account is created anymore?
Yes. There is no additional, separate log for deliveries sent through the Trust Network. They are recorded in the same reports as every other delivery:
- Delivery Report
- Monthly delivery report
- Delivery Download Report, if enabled
These show sender, recipient, date, subject, file names and downloads. What each report contains is described in Admin Reports.
Example: Erika Mustermann at Beispiel AG sends a delivery to Max Mustermann at Muster GmbH, whose domain is verified. The delivery arrives directly in his account on secure.muster-gmbh.de. Beispiel AG can still use the reports to see when Max Mustermann downloaded the files.
Is there an export of Trust Network events, for example for a SIEM?
Whatever you evaluate today, you can evaluate with the Trust Network too, in the same way. Because Trust Network deliveries end up in the same reports, there is no separate export for Trust Network events and no new interface to connect. An existing evaluation stays valid unchanged.
What does the administrator of the partner organization see?
Administrators of the partner organization see the following information:
| Area | Visible information |
|---|---|
| Trust Network | the name of the partner domain, the date of the first exchange and the date of the most recent exchange |
| Reports | for a delivery, the same information that is available to the other side: sender, recipient, date, subject, file names, downloads and more |
This visibility is intentional: partner companies need to be able to track which data enters their organization. This works in both directions. As soon as you have verified your own domain, you can likewise track when your employees receive data and download it.
Example: After a delivery from Beispiel AG to Muster GmbH, the administrator of Muster GmbH sees the entry filetransfer.beispiel-ag.de in the "Trust Network" area, together with the date of the first and the most recent exchange. In the "Reports" area, they see the sender, recipient, date, subject, file names and downloads for that delivery.
Data retention
What happens when the sender deletes a delivery?
If the sender deletes a delivery sent through the Trust Network, the message body and attachments are deleted at the recipient organization as well. Control over the delivery therefore stays with the sender, exactly as it does for deliveries within a single instance.