Security and data handling
Liscaragh Migrate is built so that your data, and your tenant details, never leave your control. It runs on your machine, moves data straight into your Microsoft 365 tenant, and sends nothing to us.
This page is written to be handed to a security reviewer or attached to a procurement questionnaire. If you need anything here confirmed in a specific format, get in touch.
Where your data goes
Liscaragh Migrate runs entirely on a Windows machine you control. It reads from your source, and it writes into your Microsoft 365 tenant, directly. No file, no folder listing and no tenant identifier is ever routed through a Liscaragh server. There is no Liscaragh cloud service in the path, because there is no Liscaragh cloud service at all.
Each file streams through a small temporary folder on the transfer machine: downloaded from the source, uploaded to Microsoft Graph, verified, then deleted before the next file. Only one file is ever on local disk at a time, so nothing accumulates and nothing is staged in bulk.
The controls, in plain terms
Read-only against the source, enforced in code
The tool can only ever read from the source. There is no write, delete or rename path to the source in the software, and an automated check fails the build if one is ever added. Your live system is never modified while you are still working in it.
Encrypted in transit, both legs
Every transfer runs over TLS: from the source to the transfer machine, and from the transfer machine to Microsoft 365. A source endpoint that is not HTTPS is refused rather than used.
Encrypted at rest while staged
Files waiting in the temporary folder are AES-256 encrypted, with a key that exists only in memory for that run and is destroyed when the run ends. Anything a crash leaves behind is unreadable and is swept on the next run.
Least-privilege access to Microsoft 365
Access is through a Microsoft Entra app registration in your own tenant, scoped to what a migration needs. A guided setup creates the application and certificate. You own it, and you can revoke it at any time.
Credentials stay on the machine
The Datto secret and the certificate are entered on first run and held by Windows on that machine. Nothing sensitive is baked into the installer, and no credential is read, stored or logged by the tool itself.
A complete, tamper-evident audit trail
Every file has an audit row: its path, size, content hashes, original modified date and outcome. A provenance pack can countersign that manifest with an independent RFC 3161 timestamp, and only the manifest's 32-byte hash ever leaves the machine.
Licensing: one outbound check, and it carries no tenant data
A licence is a small signed file, checked entirely on your machine. Validating it needs no network call. The one exception is a revocation check: periodically, not on every run, the tool fetches a public revocation list from GitHub, so a licence cancelled for a chargeback or similar stops working within a reasonable time. That check is a plain fetch of a published list. It does not carry a tenant identifier, a file name or any customer data, and it is not sent to any Liscaragh server, there is no Liscaragh server to send it to. If GitHub cannot be reached, the check fails open for a period rather than blocking a migration. One licence covers one Microsoft 365 tenant, for life.
Evaluation mode keeps a local, anonymous count so a free trial cannot be looped: it is a one-way hash of the tenant identifier and a number, held only on that machine. It contains no tenant name, no file names and no customer data, and it is never transmitted. If it cannot be read, it fails open rather than blocking a migration.
What we can and cannot see
Because nothing routes through us, we do not see your files, your folder names, your tenant, or how much you moved. That is a deliberate design choice, and it has a trade-off worth stating plainly: if something goes wrong, we can only help from what you choose to send us. The built-in support bundle lets you attach a run's log and report to a support email, and you decide what goes in it.
What is and is not migrated
Liscaragh Migrate moves current file content and folder structure into SharePoint or OneDrive. Two things are worth flagging up front, because they are a function of what the source APIs expose rather than a limitation of the tool:
- Version history from the source is not carried across. The API exposes current content only.
- Share permissions from the source are not applied at the destination. The tool can produce a read-only permissions plan that maps source share roles to intended Microsoft 365 access, for you to review and apply deliberately, but it never writes permissions itself.
If either is a compliance requirement for your migration, plan for it before you start, and talk to us if you want help scoping it.