AS2 requires a publicly accessible HTTPS endpoint. SFTP needs a server and open port 22. Hosted MFT routes every byte through a vendor relay. PeerAegis is built around one question: what does each component actually need to know?
File bytes travel directly between your enrolled endpoints over DTLS-encrypted WebRTC DataChannels. The infra-server brokers the session — it never receives, stores, or handles your data. A compromised relay reveals nothing.
Built-in STUN/TURN relay — embedded in your infra-server binary — means no open inbound ports, no VPN dependency, no external relay subscription. PeerAegis tries a direct peer connection first; if a NAT blocks it, traffic relays through your server, encrypted end-to-end.
Crypto mode, cipher suite, file-type glob patterns, and size limits are configured server-side and injected into the SDP offer at relay time. Neither endpoint can negotiate them down — not even a modified daemon binary can bypass them.
Three components. One encrypted peer connection. Files go from sender outbox to receiver inbox without touching anything in between.
Install the daemon — Windows Service or Linux systemd. Generate a single-use enrolment token from the admin panel. The daemon connects, authenticates with an Ed25519 challenge-response, and registers its public key. The private key never leaves the machine.
Set crypto mode, cipher suite, compression, and file-type rules for each directional relationship. Policy is server-enforced and injected at session time. Choose sign+encrypt for external partners — confidentiality and sender authentication in one pass.
The daemon polls the outbox folder every 15 seconds. A file appears — it opens a peer connection, streams the file in 32 KB chunks directly to the receiver's inbox, and archives it to sent/ on success. No portal. No manual upload. No babysitting.
AS2, SFTP, and hosted MFT platforms all route your bytes through at least one intermediate server — a server your compliance team doesn't fully control. The MOVEit breach showed exactly what that surface costs. PeerAegis doesn't use that model. Your audit team gets exportable evidence — file hash, timestamp, sender identity, crypto mode used. Your IT team gets no relay server to maintain or patch.
Lab results, imaging files, trial data — each file is encrypted at the application layer with cryptographic sender authentication. The transfer log records who sent what, when, that the file arrived intact, and that no byte was altered in transit.
No shared multi-tenant relay. No cloud-provider data residency question. The infra-server runs on your hardware or your approved cloud environment. IP whitelist enforcement at the server level means only known CIDR ranges can enrol or connect.
EDI files, shipping documents, customs data — PeerAegis works across NATs and corporate firewalls without a VPN tunnel or an exposed AS2 endpoint. Enrol a partner station. They drop files in an outbox; you receive them in an inbox. No portal login, no AS2 endpoint to publish, no SFTP credentials to rotate.
We provision a hosted signaling server for you. You download the daemon, enrol two stations, and transfer your first file within one business day of requesting.