What each protocol actually does
AS2 wraps each business document in an encrypted, digitally signed HTTP message addressed to the partner's endpoint. The receiver returns a signed MDN (message disposition notification) — a cryptographic receipt proving the exact bytes arrived intact. Signing, encryption, and receipt are per message, which is why auditors and large retailers like the protocol. SFTP works at the file level: your system logs into a secure server over SSH and uploads or downloads X12 files from agreed folders, on a schedule or on demand. The channel is encrypted, authentication is by key or password, and there is no native receipt — you learn a file arrived when the partner's next process (often a 997 acknowledgement) says so.
The security models, compared
Both protocols encrypt data in transit when configured correctly. AS2 adds non-repudiation per message: the signature proves who sent it and the MDN proves who received it, which settles “we never got it” disputes with math instead of meetings. SFTP's guarantees live one layer down — the SSH channel is secure, but proof of business delivery comes from document-level acknowledgements rather than the transport itself. Neither protocol forgives sloppy key or certificate hygiene: expired AS2 certificates and rotated-but-uncommunicated SFTP keys are two of the most common preventable outages in small EDI operations.
What each demands from your team
Self-hosted AS2 means operating a publicly reachable endpoint with valid certificates, exchanging keys and endpoint details with every partner, and handling asynchronous MDNs — including the retries when a partner's endpoint is slow. Self-hosted SFTP means managing server credentials, folder conventions per partner, polling schedules, and archival so a reprocessing never double-sends an invoice. Both are well-understood work, and both are work a five-person operations team should not own. A hosted platform absorbs certificates, endpoints, mailboxes, retries, and receipt tracking, which collapses the AS2-vs-SFTP decision from an infrastructure project into a per-partner configuration choice.
What partners actually mandate
In practice the partner packet answers this question before you do. Large retailers and grocers predominantly specify AS2 with their identifiers, certificates, and testing steps spelled out; many mid-market partners, 3PLs, and healthcare-adjacent workflows accept SFTP drops with folder and filename conventions. Some partners support both and let you pick. Read the packet first, configure what it says, and keep the other option available for the next partner — mixed estates are the norm, not a migration failure. Partner-specific requirement pages, starting with Walmart and Target, show how mandates read in the wild.
A short decision framework
First, follow the mandate — if the packet names a transport, that is your answer for that partner. Second, if both are accepted, prefer AS2 where proof-of-delivery matters most (high-value invoices, strict chargeback regimes) and SFTP where operational simplicity wins (batch drops to a warehouse partner, overnight schedules). Third, never self-host to save a subscription line item: compare the fully loaded cost — staff time, certificate renewals, outage response — against published platform pricing such as SignalEDI's Seasonal $99, Starter $199, Growth $999, and Enterprise $1999 monthly tiers on the pricing page. The transport is a detail; reliable validation, acknowledgement tracking, and exception handling are the system. Our onboarding guide walks through connection setup as part of first-partner certification.
Proving the connection before go-live
Whichever transport you configure, certification follows the same rhythm. Exchange identifiers and credentials first — AS2 certificates and endpoint URLs, or SFTP host keys, usernames, and folder paths — and confirm the channel with a connectivity test before any business content moves. Then send the partner's required test documents (typically an 850/856/810 set) and collect the matching acknowledgements: signed MDNs on AS2, document-level 997s on either transport. Keep those receipts as your certification evidence, and keep the test partner profile isolated from production so a rehearsal can never emit a live invoice. Validate every sample locally first with the free EDI validator so certification rounds test the connection, not your document structure.