No gpg command anywhere
Encryption is a step on the pipeline, not a script sitting next to it. Nothing extra to install on the server, nothing scheduled separately, and no batch file that quietly stops working when the person who wrote it moves on.
PGP file transfer
Encrypt and decrypt PGP files as part of the transfer
A partner tells you their files have to be PGP-encrypted. What usually follows is a second job bolted onto the first: the transfer runs on its schedule, and somewhere beside it sits a gpg line in a batch file — or a person who encrypts each file by hand before dropping it in the outbound folder.
Both break the same way, and quietly. The encryption step is the one holding the key, so it is the step nobody wants to touch; when the partner rotates their key, or the folder is renamed, or the person who set it up moves on, the failure does not announce itself. You hear about it from the partner.
How it works
-
Import the key
Your partner’s public key for the files you send them, and your own keypair for the files they send back. Keys are imported by hand in Settings — nothing is ever fetched from a key server. Paste a full keypair where a partner’s key belongs and only its public half is kept.
-
Add it to the pipeline
PGP encrypt and PGP decrypt are two of the processors on the pipeline itself, alongside unzip, HL7 and the rest, running on the schedule you already use or when a file lands in a watched folder. Pick the key from a dropdown — the processor stays greyed out until one is imported, so a pipeline that could never run cannot be built.
-
The order is decided for you
Decrypt runs before everything else, because an encrypted file is opaque bytes and nothing downstream can read it. Encrypt runs at the end, immediately before the delivery is confirmed. There is no way to drag the steps into an order that quietly sends the wrong thing.
-
Read the history instead of the logs
Every run and every file is recorded and searchable, with a receipt showing where each file went and when it got there — so “did last night’s file go out, and did it go out encrypted?” is a page to open, not an investigation.
What you get
Their key out, your key in
Outbound files are encrypted with the partner’s public key; what comes back is decrypted with your own keypair. Both directions live on the same pipeline, so one feed stays one thing to look after rather than two.
The format they actually asked for
Binary .pgp, which is what gpg writes and what most partners expect, or ASCII armor .asc for the one who insists on a text file. It is a dropdown, not a rebuild.
Decrypted files keep their real name
An inbound claims.hl7.pgp is delivered as claims.hl7. The system waiting downstream sees the filename it expects, instead of whatever your partner’s tooling stuck on the end of it.
Everything else can still read the file
Because decryption happens first, the rest of the pipeline works on the plaintext: HL7 and X12 checking, the empty-file check, record counts and renaming all behave on an encrypted feed exactly as they do on a plain one.
The receipt covers what actually landed
Encryption runs last, immediately before delivery is confirmed, so the file read back and checked is the encrypted one sitting on the partner’s server — not the plaintext you started with.
The day they forget to encrypt
A partner sending one file in the clear is a real event, not a corner case. Decide per pipeline whether that file stops at the door or passes through with a note, rather than finding out months later that nothing ever checked.
Keys stay where you put them
Held in one place, behind the same admin, creator and viewer roles as everything else, in a database encrypted at rest with AES-256. A technician can run the feed without ever handling the key material.
How this looks in your industry
The same job, in the places it usually turns up.
Healthcare
Payers and clearinghouses that will only accept an encrypted 837, and send the 835 back the same way. The X12 still has to be checked before it goes anywhere, which means the file has to be decrypted before anything can look at it.
Finance & accounting
Bank files, positive-pay uploads and payroll returns, where PGP is written into the agreement rather than suggested. Every partner with their own key, their own cut-off and their own idea of the right file format.
Logistics & retail
A trading partner adds an encryption requirement to an EDI feed that has run untouched for years. The purchase orders and ship notices did not change; only the wrapper around them did, and now somebody owns a key.
IT & managed services
Encryption you inherited — a gpg line in someone else’s script, on a server nobody has logged into in a year. One place to hold the keys across clients, and a history to point at when one of them asks about last night’s file.
One flat annual license, self-hosted
PGP encrypt and decrypt are part of the license, not a separately priced add-on. Unlimited pipelines and connections on your own infrastructure, or start a 14-day free trial — no credit card.