Install the Foldr appliance inside your network beside your file servers, publish it over HTTPS, and people open their normal shares from a browser, a desktop app or a phone, from anywhere, with nothing to connect first. Your file servers stay inside; what you publish is Foldr itself. Whether each person's own Windows permissions decide what they can open depends on how you set the share up: open it as the signed-in person and they do, open it through a service account and Foldr has to do the filtering instead (more on that below).
The appliance is a virtual machine on your network. It talks SMB to your file servers the way a Windows PC would, and it talks HTTPS to people. Only the HTTPS side is published, so what is exposed to the internet is Foldr’s web application (its sign-in page, and its file, search and sharing features behind it) and not a file server.
Add your SMB shares, DFS paths and Active Directory home folders to Foldr. Nothing has to be migrated. People sign in with their directory account (or single sign-on) and see the shares they are allowed to use.
The web app works in a browser. The Windows and Mac apps mount the shares as a drive, and the iOS and Android apps browse and share, all through the same published address.
On an SMB share you choose whether Foldr opens files as the signed-in person or through a service account. Opening as the person means their own Windows permissions are what the file server checks. Opening through a service account means Foldr filters access for them instead, if you turn that filtering on for the share.
Because people sign in to Foldr rather than to your network, the controls that matter are Foldr’s: two-factor sign-in, passkeys, single sign-on, and IP and country restrictions on your firewall.
Pick the one that suits the network you have. The knowledge base walks through each of them (Accessing Foldr from outside your network).
Point a public address at the appliance and open port 443 (and 80 if you want free Let’s Encrypt certificates and automatic redirects to HTTPS).
Publish Foldr through a proxy you already run (nginx, IIS Application Request Routing, HAProxy or Caddy) so no dedicated public address is needed.
The appliance includes support for Cloudflare Tunnel, which makes an outbound connection to Cloudflare, so you open no inbound port (the firewall still has to allow that outbound connection). Cloudflare’s free tier limits a single upload request to 100 MB. Setup guide.
If you have Microsoft Entra ID P1 or P2, a private network connector on a Windows server publishes Foldr through Entra without opening an inbound port. Setup guide.
The HTTPS setup described on this page gives people their files, not a route onto your network. Applications that need a path to a server, such as a database or a remote desktop, still need whatever you use today.
An exposed Foldr is a web app on the internet, so the usual care applies: strong passwords, MFA or passkeys, patches, backups and a look at the access logs.
Active Directory sign-in over LDAP and Kerberos single sign-on are appliance features. They are not available on Foldr Cloud.
Foldr Cloud suits storage that is already reachable from the internet, such as SharePoint, OneDrive, Google Drive, S3 or a server you already publish, with no appliance to run. A file server behind your firewall joins Foldr Cloud through the Edge agent: a small program (Windows or Linux) that sits beside the server and only ever connects out to Foldr, so you open no inbound ports. It opens files as the account you give it, so the server’s own permissions still apply.
Once people are in, the same address also gives them one search across the lot, and sharing with people outside without a VPN account for them either.
Try it free for 30 days, no credit card. Or get in touch about self-hosting.
