SaaS vs Downloadable AS2 Software: Which Do You Need?

TL;DR: Downloadable AS2 software (Aayu’s AS2 Gateway) runs on infrastructure you own and control, so your data and certificates stay inside your environment, but you own the installation, patching and maintenance. SaaS AS2 software (Aayu’s MFT Gateway) is hosted for you and used through a browser or API, with nothing to install or maintain, while your data passes through the vendor’s infrastructure. Both implement the same AS2 protocol (RFC 4130), so the choice is about operational ownership, not capability. Pick the self-managed AS2 Gateway when data residency, high steady volume, deep on-premise integration, restricted networks, or a capable IT team point that way. Pick the hosted MFT Gateway for everything else.

The “SaaS vs downloadable” question gets framed as if one option is more serious or more secure than the other. It isn’t. Any compliant AS2 software, hosted or installed, implements the same RFC 4130 standard: the same encryption, the same digital signatures, the same MDN receipts your trading partners expect. A message sent from a hosted account and a message sent from a server in your own data centre are indistinguishable on the wire.

So the real question isn’t which is better. It’s who should own the operational weight, you or a vendor. At Aayu the two answers have names: MFT Gateway is the hosted SaaS path, AS2 Gateway is the downloadable, self-managed path, and they share the same protocol engine. This guide walks through what each model actually is, the conditions that point to one over the other, and the middle ground most people forget exists.

What “downloadable AS2 software” actually means

Downloadable AS2 software is exactly what it sounds like. You go to an AS2 software vendor, do the AS2 download, and install the bundle on a machine you control: a server in your data centre, a virtual machine, a container, or a desktop for evaluation. With AS2 Gateway that really is the workflow, download, extract, run, on Windows, Linux or Mac. It runs locally. You hold the certificates, the configuration and the logs, and your business documents are processed inside your own environment.

This is the model people mean when they say “on-premise,” “standalone,” or “self-managed.” It gives you maximum control and maximum responsibility in equal measure. The AS2 server software is yours to run: you patch it, you back it up, you renew certificates before they expire, and you keep it reachable for your partners.

What “SaaS AS2” actually means

SaaS AS2 flips the ownership. You sign up online, the vendor hosts everything, and you use it through a browser or an API. There is no AS2 download, no install, no server to maintain. With MFT Gateway you add a trading partner, exchange certificates, and start sending and receiving, often the same day.

Under the hood it’s still AS2 communication software doing identical work; the difference is that the infrastructure, scaling, uptime and certificate lifecycle sit with the vendor. You trade a degree of control for the removal of operational overhead. For many teams, especially those without dedicated integration staff, that trade is the whole point.

When downloadable AS2 software is the right call (5 conditions)

The self-managed AS2 Gateway earns its keep when one or more of these is true. You don’t need all five; one strong reason is usually enough.

1. Data sovereignty or compliance forbids third-party hosting

Some regulatory regimes and customer contracts explicitly prohibit business data passing through a third party’s systems. GDPR data-residency clauses, certain HIPAA arrangements, and government or defense contracts can all require that documents stay inside infrastructure you own and audit. If your legal or compliance team has ruled out external hosting, downloadable AS2 software is the direct answer: AS2 Gateway runs entirely inside your environment, on-premise or in your own AWS, GCP, or Azure account, with your AS2 server, your certificates, and your message data under your jurisdiction. For teams that want hosted convenience but still need residency, MFT Gateway can also be deployed into your own AWS account in a chosen region, which keeps your AS2 EDI software within a boundary you define.

2. High and predictable volume

Shared SaaS plans are priced in tiers that scale with message volume. That is efficient when volume is low or variable, and less so once you cross into high, steady throughput and stay there. When you are moving a large, predictable stream of messages every month, a dedicated or self-hosted AS2 Gateway deployment, sized once for that throughput and running on infrastructure you control, gives you a more predictable cost than climbing shared volume tiers. Aayu’s enterprise and on-premise AS2 Gateway deployments are built for exactly this, handling high message volumes on dedicated or customer-owned infrastructure. Run the numbers against your real monthly volume; when it is both high and steady, a dedicated deployment tends to win on predictability.

3. Tight integration with internal systems

If your AS2 endpoint needs to feed documents straight into systems inside your network, an on-premise ERP, a warehouse or order-processing pipeline, or internal file shares; running the software locally keeps that traffic on your own network instead of bridging out to a hosted service. AS2 Gateway is built to sit next to those systems: it pushes inbound messages and pulls outbound ones through local filesystem folders, SFTP, AWS S3, webhooks, and a REST API, and supports custom integrations for less standard setups. The AS2 client and your back-office systems exchange files directly on the same network.

4. Restricted networks and static-IP partner requirements

Two related situations point to self-hosting. First, networks are locked down tightly enough that routing traffic through a third-party cloud service is off the table for policy or security reasons. Second, trading partners who only accept connections from a known, fixed set of IP addresses. Aayu’s hosted MFT Gateway uses dynamic IP addresses by default (static IP addresses can be allocated for higher tiers), which can change over time, so partners that demand a static IP are a poor fit for the default SaaS setup. A self-managed AS2 Gateway, running on your own server or cloud instance, gives you an endpoint and IP you control, which is exactly what those partners want to see.

5. You have the IT team to run it

This is the condition people skip, and it’s the one that sinks projects. Downloadable software means your team owns the lifecycle: installing it, patching it, monitoring it. If you have staff who can carry that, standalone is viable. If you don’t, it becomes a liability no matter how good the other four reasons look.

When SaaS AS2 is the right call (5 conditions)

The MFT Gateway case is largely the inverse, and it fits a surprisingly wide band of businesses.

1. You don’t have IT ops capacity to spare

If there’s no one to patch a server, watch uptime, hand that work to the vendor. MFT Gateway removes the entire operational queue. This is the single most common reason teams choose hosted AS2 file transfer software: not because they can’t run a server, but because they’d rather their people work on something else.

2. Variable, seasonal, or modest volume

When your message volume swings with the season or sits at low-to-moderate levels, paying for the tier you actually use works in your favour instead of provisioning for a peak that’s idle most of the year. The cost logic that favours a dedicated deployment at high steady volume reverses here, and a shared MFT Gateway plan is the cheaper, simpler fit.

3. You need to be live quickly

A hosted MFT Gateway account can be exchanging test messages with a partner within hours. There’s no hardware to procure, no install, no environment to stand up, and the AWS serverless architecture scales without you planning capacity. When a retailer or regulator has handed you a deadline to be AS2-capable, speed to onboard is often the deciding factor.

4. You want the vendor to own scaling and uptime

MFT Gateway’s serverless infrastructure absorbs volume spikes without you planning for them and carries the uptime obligation. If you’d rather not be the one paged when a server falls over, that responsibility shift has real value.

5. Standard integration paths are enough

If your systems can talk to the service over a REST API, SFTP, AWS S3, or webhooks, and you have no static-IP or data-residency rule forcing everything inside your own walls, MFT Gateway removes work without costing you anything you need. Those are the same integration surfaces AS2 Gateway offers, just operated for you.

Side-by-side comparison

The middle ground: downloadable software on a cloud VM

The framing of “on-premise versus cloud” hides a third option that fits a lot of teams: run the downloadable AS2 server software on a cloud instance you control. AS2 Gateway supports exactly this, with a ready-made AWS EC2 image, deployment onto your own GCP or Azure account, container platforms like Docker and Kubernetes (EKS, GKE, AKS), and Heroku or other PaaS.

You get the control characteristics of self-managed software, your installation, your configuration, a static IP you own, data inside your account, without owning physical hardware. You still patch and maintain it, so it isn’t zero-effort, but it sidesteps data-centre logistics and gives you cloud elasticity. For teams that need a fixed endpoint and full data control with no appetite for racking servers, this is often the sweet spot. We unpack the trade-offs across all three in AS2 deployment in 2026: cloud, hybrid, or on-premise.

What Aayu offers for each path

Aayu Technologies covers both ends, so the deployment model doesn’t dictate the vendor.

MFT Gateway is the SaaS path: a hosted AS2 and SFTP service with nothing to install, used through a browser or API and built on AWS serverless infrastructure so it scales without capacity planning on your side. It integrates with internal systems over AWS S3, SFTP, webhooks and a REST API. For teams with a data-residency requirement that still want SaaS, it can be deployed into your own AWS account in a chosen region.

AS2 Gateway is the downloadable, self-managed path: a dedicated AS2 server you install and run wherever you need it, Windows, Linux or Mac for a simple install, or on-premise and dedicated deployments on your own AWS, GCP or Azure account, Docker or Kubernetes clusters, or Heroku or other PaaS. It gives you a web portal for manual use and a REST API for automation, an in-product certificate manager with scheduled renewals, email notifications, audit trails, and support for very large files (tested to 100GB) including FDA and EMA regulatory submissions, all with your data under your control.

They share the same protocol engine, so partners can’t tell which one you’re running. If you’re weighing the two, the difference between MFT Gateway and AS2 Gateway lays the deployment and use-case distinctions out in detail.

Frequently asked questions

Is SaaS AS2 less secure than downloadable AS2 software?

No. Both implement the same AS2 standard, encryption, digital signatures and MDN receipts under RFC 4130. Security depends on how the software is configured and operated, not on whether it’s hosted or installed. The meaningful difference is where your data resides and who is responsible for maintaining the system, which is a control-and-compliance question rather than a security-capability one.

Will my trading partners know which deployment model I use?

No. Trading partners interoperate with your AS2 endpoint over the AS2 protocol; they don’t see whether it’s a hosted MFT Gateway account or an AS2 Gateway server you installed. What they care about is a reachable endpoint, valid certificates and correct MDN handling. Some partners do require a static IP, and because MFT Gateway uses dynamic IPs by default, that requirement is one practical reason to choose a self-managed AS2 Gateway deployment.

Which is cheaper at high volume?

It depends on how steady the volume is. Shared MFT Gateway tiers are efficient at low, modest or seasonal volumes because you pay for the bracket you use. A dedicated or self-hosted AS2 Gateway deployment, sized once and run on infrastructure you control, tends to be more predictable and economical once volume is both high and sustained over time. Run the numbers against your real monthly message counts rather than a list price; the crossover point varies by business.

Can I start on SaaS and move to standalone later?

Often yes, and it’s a sensible path. Many teams start on MFT Gateway to hit a partner deadline quickly, then re-evaluate once volume, integration depth or compliance requirements become clearer, moving to a dedicated AWS deployment or to AS2 Gateway on-premise. Because both products run the same AS2 protocol, that move doesn’t change how your partners connect to you.

Try the one that fits, free

You don’t have to commit to settle this. Both Aayu products give you full feature access on a 30-day trial with no credit card, so you can set up a real trading partner, exchange certificates, and run an end-to-end AS2 test before you pay anything.

• Need full control of your data and infrastructure? Download AS2 On-premise and install it on your own server, cloud account, or container platform.
• Want hosted AS2 with nothing to install or maintain? Start a free MFT Gateway trial and exchange test messages with a partner today.
• Still weighing residency, volume, or a tricky partner setup? Contact Aayu and the Aayu team will map your requirements to the right deployment before you start.

Same AS2 protocol, same trading-partner experience. The only real decision is who runs it, and you can test both answers this week.