// SECURITY
Security by design
Controls are designed to keep migration analysis inspectable, scoped and reviewable.
01 / Least privilege
Migration Analyst connects to source and target systems using dedicated, scoped identities. Each connector requests only the metadata and sample-read permissions required for analysis — never write access, and never full data export by default. We recommend customers provision a read-only, time-boxed credential for each engagement.
02 / Data minimisation
Our workflow is metadata-first: schema structure, relationships and field-level statistics drive most of the analysis. Where representative sample values are needed to validate transformation rules, we recommend masked or synthetic data wherever practical, and the platform is built to work with small, targeted samples rather than full data extracts.
03 / Know where your PII lives before you migrate it
Legacy systems rarely come with a map of where personal or sensitive data actually sits. Migration Analyst scans source schemas and representative samples to flag fields likely to hold PII — names, emails, dates of birth, government identifiers and more — surfacing them early enough to inform masking, access control and governance decisions, rather than discovering them after data has already landed in the target system. This runs as part of the same analysis used to build your ERD and domain map, so PII visibility isn't a separate audit — it's built into how the migration is planned.
04 / Auditability
Every mapping, transformation rule, validation result and approval is captured in a portable specification (JSON) with a timestamped history of who did what and when. This gives your architecture, engineering and governance stakeholders an independently reviewable record — not just a snapshot at sign-off.
05 / Infrastructure and encryption
Migration Analyst runs as a local application on your own infrastructure — there is no cloud service processing or storing your migration data on our side, so schema metadata and samples never leave your environment unless you choose to export them. This website (used for enquiries and pilots only) runs on Vercel's infrastructure in the United States and is served entirely over HTTPS/TLS.
06 / Access control
Migration Analyst uses a shared database, hosted within your own environment, to manage per-named-user access and role-based permissions separating analysts, reviewers and administrators. This database — like all migration data — stays inside your infrastructure and is never hosted or accessed by us. Access is currently authenticated with username and password; SSO is on our roadmap.
07 / Sub-processors and third parties
Migration Analyst is a local application and has no sub-processors — it does not send your migration data to us or to any third party. This website uses Vercel (hosting) and Resend (transactional email delivery) to operate enquiry and contact forms only.
08 / Current certifications and roadmap
Migration Analyst is in early access. We have not yet completed independent security certification (e.g. SOC 2, ISO 27001). Formal certification is on our roadmap as the product moves toward general availability — customers with specific compliance requirements are welcome to raise them during scoping so we can address them directly.
09 / Reporting a concern
If you believe you've found a security issue, please contact security@3csconsulting.com.au. We aim to acknowledge reports within [2 business days] and will work with you to understand and address the issue.