Episode 4 of the Customer Confidence Webinar Series: Branded Communications Drive Digital Adoption

An update to InvoiceCloud SFTP Servers 

What’s Happening and Why It Matters 

We’re strengthening the encryption standards on our SFTP (Secure File Transfer Protocol) servers which is the technology used to securely exchange files between your system and InvoiceCloud. As part of our commitment to industry security standards (NIST SP 800-52 Rev. 2 and PCI DSS 4.0.1), we’re retiring a set of older, weaker encryption methods and replacing them with stronger ones.  

 

Think of it like upgrading the locks on a door: the old locks still work, but the new ones are significantly more secure. Most customers won’t notice a thing — but if your system is using one of the older methods, it will need a quick update before the cutover date.  

 

The Timeline 

We’re rolling this out in two phases so you have time to test before anything changes in production:  

  • Beta environment (available now for testing): sftp.invoicecloud-beta.com  
  • Production environment (effective 7/26/2026): sftp.invoicecloud.com  

We strongly encourage your technical team to test a connection to the beta environment before July 26, 2026 to confirm everything works as expected.  

 

Do You Need to Take Action? 

Probably not — if your organization uses a modern, up-to-date SFTP client (such as OpenSSH 7.4+, WinSCP 5.x+, Cyberduck, or FileZilla 3.x+), your connection will continue working automatically with no changes required.  

You may need to act if your organization uses older SFTP software or your IT team has manually configured specific encryption settings in your SFTP client.  

The easiest way to check: Have your IT team connect to sftp.invoicecloud-beta.com using your current credentials and setup. If it connects successfully, you’re all set. If it doesn’t, please reach out to us before 7/26/26 as we’re here to help.  

 

For Your Technical Team: What’s Changing 

The following algorithms will be disabled on July 26, 2026: 

Key Exchange (KEX) – Removed: 

  • ecdh-sha2-nistp256  
  • ecdh-sha2-nistp384  
  • ecdh-sha2-nistp521  
  • diffie-hellman-group14-sha256  

Host Key Algorithms – Removed: 

  • ecdsa-sha2-nistp384  

MAC Algorithms – Removed: 

  • hmac-sha2-256 (non-ETM)  
  • hmac-sha2-512 (non-ETM)  

 

The following algorithms will continue to be supported: 

Key Exchange (KEX): 

  • curve25519-sha256  
  • diffie-hellman-group-exchange-sha256  
  • diffie-hellman-group16-sha512  
  • diffie-hellman-group18-sha512  

Host Key Algorithms: 

  • rsa-sha2-512  
  • rsa-sha2-256  
  • ssh-ed25519  

Encryption Ciphers (no changes – all current ciphers remain supported): 

  • aes128-ctr, aes192-ctr, aes256-ctr 

MAC Algorithms: