> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mention-me.com/llms.txt
> Use this file to discover all available pages before exploring further.
# SFTP File Encryption
> How to use PGP encryption for SFTP batch files, including self-serve key management, inbound and outbound encryption, key rotation, and strict mode
## Overview
Mention Me supports OpenPGP encryption for files transferred via SFTP, in both directions:
* **Inbound** (you to Mention Me) - you encrypt files with a public key before uploading them, and Mention Me decrypts them on receipt.
* **Outbound** (Mention Me to you) - Mention Me encrypts reports and data feeds with your public key before delivering them to your SFTP folder.
There are two ways to encrypt inbound files:
1. **Shared key** - a single public key shared across all merchants, suitable for basic encryption needs.
2. **Dedicated keys** - PGP keys specific to your account, which you generate and manage yourself in the platform. Dedicated keys support per-folder scoping and key rotation, and are recommended for merchants with stricter data-security requirements.
Encryption is optional and set per folder. You can manage dedicated keys and mark folders as encrypted yourself from the **Encryption keys** tab on the [SFTP page](https://mention-me.com/merchant/~/sftp/). Contact the Support Team using the [Help form](https://help.mention-me.com/hc/en-gb/requests/new?ticket_form_id=8840645829405) if you would like help setting it up.
## Managing your keys in the platform
Dedicated keys are managed from the **Encryption keys** tab on the [SFTP page](https://mention-me.com/merchant/~/sftp/). The tab lists your keys with their direction (inbound or outbound), scope, fingerprint, active state, and creation date, and keeps a full history per scope.
Keys can be set at two levels:
* A **default key** covers every inbound (or outbound) folder that does not have its own key.
* A **dedicated key** applies to a single folder, so different data feeds can use different keys.
A folder's own key is always used before the default key.
Setting a dedicated key on a folder marks that folder as encrypted. Inbound folders then require encrypted uploads (see [Strict mode](#strict-mode)), and outbound files for that folder are encrypted before delivery.
### Generate an inbound key
For files you send to Mention Me, use **Generate inbound key** and choose a folder, or set it as your default key. Mention Me generates a key pair and shows you the **public key** and its fingerprint, which you can copy or download. Generating a 4096-bit key can take up to 30 seconds.
The private key is held securely by Mention Me and is never displayed or downloadable. Encrypt your uploads with the public key shown here (see [Inbound encryption](#inbound-encryption-you-to-mention-me)).
### Import an outbound key
For files Mention Me sends to you, use **Import outbound key**, choose a folder (or set it as your default key), and paste or upload your own armoured **public key**. Mention Me validates it and shows its fingerprint, then encrypts your outbound files with your key so you can decrypt them with your private key.
Only ever share your public key. Never send anyone your private key.
## Inbound encryption (you to Mention Me)
When you upload files to Mention Me via SFTP, you can encrypt them with PGP first. Mention Me decrypts them automatically on receipt.
### Using a dedicated key
[Generate an inbound key](#generate-an-inbound-key) for the folder from the Encryption keys tab, then encrypt your files with the public key shown when you generated it.
Example using GPG:
```bash theme={null}
# Import the public key shown in the Encryption keys tab (one-time setup)
gpg --import your-dedicated-public-key.asc
# Encrypt a file before uploading
gpg --encrypt --armor --recipient Orders-20260715.csv
# Produces Orders-20260715.csv.asc - upload this file via SFTP
```
Once a dedicated inbound key exists for your account, files encrypted with the shared key are rejected. Encrypt to your dedicated public key, not the shared key.
### Using the shared key
If you do not use dedicated keys, you can encrypt with Mention Me's shared public key, published at [https://mention-me.com/keys/public\_batch.key](https://mention-me.com/keys/public_batch.key). Download it, import it into your keyring, and encrypt your files before uploading.
```bash theme={null}
# Import Mention Me's shared public key (one-time setup)
curl -O https://mention-me.com/keys/public_batch.key
gpg --import public_batch.key
# Encrypt a file before uploading
gpg --encrypt --armor --recipient Orders-20260715.csv
```
### Strict mode
When a folder is marked as encrypted, plaintext (unencrypted) files uploaded to it are **rejected** rather than processed. If a file is rejected:
* The file is not ingested.
* A rejection notice is written to the folder's `log/` directory, alongside the `data/` directory you upload to (see [Folder Structure](/developer-docs/integration/sftp-connection#folder-structure)).
* The rejection is final for that file, and it is not retried. Encrypt the file and re-upload it under a **new filename**, because the pipeline treats each filename as processed once.
## Outbound encryption (Mention Me to you)
When outbound encryption is enabled for a folder, Mention Me encrypts reports and data feeds with your public key before delivering them.
1. [Import your outbound key](#import-an-outbound-key) for the folder from the Encryption keys tab.
2. Once imported, all outbound files for that folder are encrypted automatically.
3. Files are ASCII-armoured, with an encryption extension appended to the filename. For example, a report normally delivered as `Fulfilment_20260715.csv` is delivered as `Fulfilment_20260715.csv.asc`.
4. Decrypt the file with your private key.
```bash theme={null}
gpg --decrypt Fulfilment_20260715.csv.asc > Fulfilment_20260715.csv
```
The default extension is `.asc`. If your tooling requires `.pgp` or `.gpg` instead, ask the Support Team to configure it. The file content is always ASCII-armoured regardless of the extension.
If a folder is encrypted but has no active outbound key, files are held rather than sent in plaintext, so encrypted folders never expose unencrypted data. Mention Me is alerted and delivery resumes once a key is in place. If an expected file does not arrive, [contact the Support Team](https://help.mention-me.com/hc/en-gb/requests/new?ticket_form_id=8840645829405).
## Rotating keys
Keys are rotated from the Encryption keys tab using the **Rotate key** action on a key's row. Generate and import only create a scope's first key; after that, use Rotate key to replace it.
* **Inbound**: rotating generates a new key pair. You can choose to keep the previous key active as a **grace key**, so files encrypted with either the old or the new public key are accepted during the changeover. There is no automatic expiry: the grace key stays active until you use **End grace period** to retire it, so you control the timing. (An inbound scope holds at most two active keys, so the oldest is retired when you rotate again.)
* **Outbound**: rotating imports a new public key, and Mention Me encrypts new files with it straight away. There is **no grace period** for outbound keys: the new key takes over immediately and previous keys stop being used. Keep your old private key until you have decrypted any files already delivered. Your chosen file extension carries over.
## Generating a PGP key pair
To import an outbound key, you first need your own PGP key pair. We recommend RSA-4096. Example using GPG:
```bash theme={null}
gpg --full-generate-key
# Select: (1) RSA and RSA
# Key size: 4096
# Expiry: set according to your security policy
# Enter your details when prompted
# Export the public key to import into the Encryption keys tab
gpg --armor --export your-email@example.com > my-public-key.asc
```
Import `my-public-key.asc` via [Import outbound key](#import-an-outbound-key). Keep the private key safe and never share it.
## Need help?
Contact the Support Team using the [Help form](https://help.mention-me.com/hc/en-gb/requests/new?ticket_form_id=8840645829405).