Same here when I worked at a Mortgage company. SFTP everywhere.
As some simply can't go with certain open source project due to compliance, we settled with Tectia SSH[1]. Similar story with VPN and other security-related stuff.
Everything is SFTP with them. Even API json response lol