Please note if you do choose the shared hosting + ssh access route for this (which I don't recommend), make sure your provider is aware of this and the volume of traffic they should expect.
Most shared hosting providers aren't geared up for monitoring bandwidth usage via SSH/SFTP nor are they designed for such purposes. Also note that many shared hosting providers, particularly those offering "unlimited" disk space, will prevent you from using their services for data backup via their terms and conditions.
Sean McRobbie - Specialising in virtualisation since 2005. ‡www.openitc.co.uk - We create, we host, we connect - Fully Managed VPS & Dedicated Hosting
ITSVPS.com Virtual Servers - Cutting edge technology, first class network, affordable prices! Managed and unmanaged. Virtual and Dedicated. Shared hosting, web design, application development, and more. Contact us here, or our website!
To recommend, it depends on how much functionality you need, how many users you have connecting, what they are doing, how secure and how audited you want the platform to be.
If you are looking for something that will always be available then you need to get a 100% uptime SLA from the company and ensure you are running on redundant branded hardware, not cheap hardware where if there is a failure you would be looking at 24 hours downtime and probably some data loss from the last backup.
You need to consider security, probably need IPS and defo the server to be behind a firewall so you only want port 22 opened for your sftp client and 443 if you want to use a web based file upload system as well.
Lastly you need an admin system to setup users, passwords, folders and permissions on the folders. You can either have a web based admin system or can login to the server remotely to configure. It's probably best to use Windows as then the interface is more user friendly. There are also event tools which can send out emails to your clients notifying them that files have been upload/downloaded etc and can also trigger other events.
There are also features such as logging that you want to consider, you want to know who has accessed what and when if you find in a few years someone you have a lawyer asking who accessed one of their files, you can send them the report.