Proof, not assurances.
Everything on this page describes how the service is built, in plain language. We'd rather make fewer claims and have each one be literally true.
Access
- You never hand us a credential
- You issue us no password, no secret and no key file. We bring our own identity and your admin grants it access, narrowly scoped, with one approval in Microsoft and one line in Google. Each of those is yours to remove, without asking us, and the access it granted ends within the hour rather than immediately, because a token already issued lives out its life.
- Read-only at the source
- Our access to your Google environment is read-only. Nothing there is modified or deleted.
- Every engagement is provisioned individually
- Each environment is provisioned for one engagement, with access scoped to exactly what the move needs. One named person sets it up and stays your point of contact throughout.
Your data
- We process your content, we never warehouse it
- Your content is copied, never kept. The copy is done by software, and no person reads your mail or opens your files. Content passes through only for as long as the copy takes. What stays with us is the record of the move, such as IDs, hashes, counts and the names of the items your report lists, and only for as long as your agreement sets.
- Encrypted in transit and at rest
- TLS on every connection to you, to Google and to Microsoft; every credential sealed with AES-256-GCM; our disks encrypted.
- Isolation is built into the foundation
- Each customer's data and credentials are isolated from every other customer's. The database itself enforces that isolation, on every read and every write.
The record
- Provable fidelity
- Files are content-hashed on both sides as they transfer, and your report accounts for what moved and what did not. The report you receive is auditable, not anecdotal.
- Audit trail
- Every job launched or canceled, every step with your credentials and every report published is written to a timestamped, append-only log. Each run records its counts, warnings, failures and exceptions, kept under your engagement terms.
The full list of third parties that may process data for us is on the Subprocessors page, and how we handle personal information is on the Privacy page.
Tell us the shape of it and you’ll have a number.
A reply from a person within one business day: the number, what it covers, and the two or three things we’d need to confirm.