Is there a more secure way that a non-data-retaining service can connect with your server so a user can update there .plan file than sftp?
There are ways of locking down an incoming ssh connection to scp-only, you can even filter the files it has access to. I looked into this once, but never implemented it b/c we went elsewhere with the project.
Note: This is by making the handling script the thing that runs for a certain ssh key, I don't think it works with a password though.
Excatly! There are many ways to set up secure ssh access. Which is why a solid, know protocol like ssh is the right one to use for remote login, because it provides many options and all sysops can configure access for their own users as they see fit, yet all users, on all systems can still follow each other.