Create an SFTP connection

SFTP connections let you import invoices or receipts by pushing files to a Complyance-hosted shared location, or by having Complyance poll your own shared location over SFTP.

Supported document flows

United Arab Emirates (AE): create an invoice connection for UAE invoice workbooks.
Malaysia (MY): one connection handles both invoice and receipt workbooks. Upload invoice files normally. To route a workbook as a receipt, include a filename prefix of receipt- or rec- (case-insensitive), for example MY-receipt-july.xlsx or rec-july.xlsx. Files without either prefix are processed as invoices.

Step 1: Name and metadata

After you choose Add connection, the Name and metadata step opens. This step identifies the connection and the documents it will ingest.

Field	What to enter
Connection name	A unique name for this connection, e.g. `AP Inbox - Production`. The name must be unique within the workspace.
Country	The tax jurisdiction for the submitted documents. The UI displays the country name and code, for example Malaysia - MY.
Environment	The target Complyance environment for submitted documents, e.g. Sandbox or Production.
Mapping template	(Locked) The template that maps source columns to the e-invoicing schema. Defaults to `default` for this flow.

For Malaysia, the Country and Environment fields appear side by side to keep the setup compact. When the fields are filled, click Next to continue to the connection type.

Malaysia file naming

Malaysia uses the uploaded filename to identify the document type, so there is no document-type selector in the connection form:

Upload an invoice workbook with its normal filename, such as july-sales.xlsx.
Prefix a receipt workbook with receipt- or rec-, such as receipt-july-sales.xlsx or rec-july-sales.xlsx.
Prefix matching is case-insensitive. Any other filename is treated as an invoice.

Step 2: Connection type

The Connection type step asks who hosts the shared location. This choice is locked after creation — switching later requires creating a new connection and re-onboarding the upstream system.

Option	When to use
Complyance shared location (Recommended)	Complyance gives you an SFTP endpoint (a shared location) that your team or partner uploads files to. Complyance handles availability and scanning.
Your own shared location	You manage your own shared location over SFTP. Complyance connects on a polling schedule and picks up new files from it.

For the Complyance-hosted walkthrough, choose Complyance-hosted shared location, then click Next to set up authentication and receive the endpoint credentials for your upstream system.

To set up a client-managed connection instead, choose Your own shared location. Complyance will connect to your shared location on a polling schedule and pick up new files. The next steps ask for your shared location's endpoint and authentication details.

Step 3: Authentication

The Authentication step decides how your upstream system proves its identity to the Complyance SFTP endpoint.

Option	What happens
Username & password	Complyance generates a username and a one-time password for the endpoint.
SSH public key	You register your upstream system's SSH public key. Your system keeps the matching private key.

Using username and password

Select Username & password.
The UI generates the Your SFTP endpoint credentials:
- Host — the SFTP endpoint address.
- Port — the SFTP endpoint port.
- Username — the account username.
- Password — the one-time password.
Copy each value and configure them in the upstream system that will upload files. Each field has a Copy button, and the password can be Regenerated if needed.
Check the box to confirm you have configured these credentials in your upstream system.
Click Next to continue.

Using SSH public key

Select SSH public key.
Paste your upstream system's public key into the SSH public key field. Use OpenSSH format. If you have multiple keys, enter one key per line.
The UI shows the generated endpoint details:
- Host — the SFTP endpoint address.
- Port — the SFTP endpoint port.
- Username — the account username.
Copy the host, port, and username and configure them in your upstream system. The upstream system connects with the matching private key.
Click Next to continue.

Client-managed authentication

If you chose Your own shared location in Step 2, the Authentication step asks how Complyance should authenticate against your shared location.

Option	What to enter
Username & password	The username and password for the account on your shared location.
Username & private key	The SSH private key that Complyance should use to authenticate with your shared location.

After entering the credentials, click Next to continue to the connection details.

Connection details for your own shared location

If you chose Your own shared location, the Connection details step asks for the remote location details that Complyance will poll.

Field	What to enter
Host	The hostname of your shared location, e.g. `sftp.yourcompany.com`.
Port	The SFTP port, usually `22`.
Username	The account username on your shared location.
Remote path	The path to the root directory that contains four folders: `inbound/`, `processing/`, `invalid/`, and `validated/`. For example, `/invoices` if the folders are `/invoices/inbound`, `/invoices/processing`, `/invoices/invalid`, and `/invoices/validated`.
Password	The account password for your shared location. This is stored encrypted at rest.

Make sure all four folders already exist in your shared location at the chosen path. Complyance polls inbound/; files that pass internal validation move to processing/. Files that fail internal validation move to invalid/ with an error workbook. Final government outcomes move processing files to validated/ or invalid/.

After entering the details, click Next to continue to customization.

Step 4: Customization

The Customization step sets up how often Complyance polls your shared location (for client-managed connections) and who receives ingestion notifications.

Field	What to enter
Lookup interval	(Client-managed only) How often Complyance connects to your shared location to pick up new files, e.g. Every 1 minute.
Email addresses	Add one or more email addresses as removable chips. Type an address and press Enter, comma, or space to create a chip. Invalid addresses are highlighted and must be corrected before saving.
Notify me when	Use independent toggle switches for Files import successfully, Files fail to import, and Duplicate files are skipped. Each switch controls whether that event sends a notification.

When the settings are set, click Next to review the connection.

Step 5: Review and create

The Review and create step shows a summary of everything you configured. Review each section:

Name and metadata — connection name, country, and environment. For Malaysia, document type is determined from the uploaded filename.
Connection type — Complyance-managed or client-managed.
Authentication — username and password, or key-based authentication.
SFTP endpoint — host, port, and username (Complyance-hosted).
Remote location — host, port, username, and remote path (client-managed).
Customization — lookup interval (client-managed), notification settings.

If anything needs to change, click Edit on the relevant section to go back and update it.

When the summary looks correct, click Create connection to finish. You can also click Save as draft to save the connection and complete it later.

After creation: Save your credentials

If you selected Username & password, a Save your SFTP password dialog appears after the connection is created. This dialog shows the full endpoint credentials one more time:

Host
Port
Username
Password (shown only once)

Important: You will not be able to see this password again after closing the dialog. Store it somewhere safe. If you lose it, you will need to rotate credentials.

Copy the password and any other credentials you need.
Check the box to confirm you have copied and stored the password.
Click Go to connection to view the connection details page.

Connection details page

After you save the credentials, you are taken to the connection details page. This page shows the connection status, endpoint credentials, and customization settings.

Activate the connection

Before you can activate the connection, you must test it:

Click Test connection. The system verifies the endpoint and credentials.
- For client-managed connections, the test confirms authentication, host reachability, and that the remote path exists.
If the test succeeds, click Activate to enable the connection.
If the test fails, check the credentials and path, then try again. For Complyance-hosted connections, you can click Rotate password to generate a new password, then re-test and re-activate.

The connection starts in Draft status. After a successful test, you can activate it to start ingesting files.

Connect with an SFTP client

You can use any SFTP client to upload files to your shared location. Popular options include FileZilla® (Windows, macOS, Linux), WinSCP (Windows), and Cyberduck® (Windows, macOS).

Whichever client you use, create a new connection with these settings from the connection details page:

Protocol: SFTP (SSH File Transfer Protocol)
Host: the host from the connection details page, e.g. thomas.proxy.rlwy.net
Port: the port from the connection details page, e.g. 18695
Logon type / authentication: username and password (or your SSH private key, if you registered a public key during setup)
Username: the username from the connection details page
Password: the password you saved during creation

After connecting, upload files to the inbound/ folder. Complyance will pick them up for ingestion.

FileZilla is a registered trademark of the FileZilla Project. Cyberduck is a registered trademark of iterate GmbH. WinSCP is a trademark of Martin Přikryl. All trademarks are the property of their respective owners.

Client-managed shared location

For a client-managed connection, connect your SFTP client to your own shared location using the host, port, username, and password you configured in the connection details. Upload files to the inbound/ folder at the configured remote path. Complyance moves internally valid files to processing/; final government outcomes move them to validated/ or invalid/.

File handling after upload

Complyance-hosted shared location

For a Complyance-hosted connection, upload files to the inbound/ folder. Complyance ingests the file and returns a status in the connection's file history.

Your own shared location (client-managed)

For a client-managed connection, your shared location must have four folders at the configured path:

inbound/ — upload invoice or receipt workbooks here. For Malaysia, use a receipt- or rec- filename prefix for receipt workbooks.
processing/ — workbooks that passed Complyance internal validation and are awaiting a final government outcome.
validated/ — workbooks accepted by the government, with their response artifacts.
invalid/ — workbooks that failed internal validation or were rejected by the government, with error or response artifacts.

Flow:

Place a workbook in inbound/.
Complyance polls the shared location at the configured interval and performs internal validation.
A workbook that fails internal validation moves to invalid/ with an error workbook.
A workbook that passes internal validation moves to processing/.
When the government outcome is available, Complyance moves all workbook artifacts to validated/ for acceptance or invalid/ for rejection.

The status of each file appears in the connection's file history.