Google-only identity
Everyone signs in through Google OAuth — DriveShift never sees or stores a password, and your organization inherits whatever MFA and session policies you already enforce in Google Workspace.
Start migration Security model
Governed by
design.
DriveShift separates user identity, tenant credentials, migration records, and audit history so each organization's migration data stays scoped and reviewable.
Per-organization credential encryption
Tenant service-account keys are sealed with AES-256-GCM envelope encryption under a key that exists only for your organization. The ciphertext is bound to your org and tenant role, and the public-facing API is not permitted to decrypt it — only the isolated migration engine can.
Your source is read-only by default
Standard migrations only read from the source tenant — nothing is modified, renamed, or restricted. The one exception, cutover, is explicit and opt-in, and refuses to touch the source unless every file copied successfully.
Content is never stored
File content streams directly between your tenants during a run. DriveShift keeps the migration graph — folders, mappings, outcomes — not your documents. Excel reports carry SHA-256 integrity checksums.
Organization-scoped everything
Organizations, members, tenants, jobs, schedules, reports, and quotas are isolated per organization in Postgres. Every request is scoped server-side; plan limits are enforced against real scan counts before a single file moves.
Append-only audit trail
Sign-ins, credential changes, billing events, team changes, and every migration lifecycle event are recorded and visible to you in the dashboard's Audit section — the same records we would use to answer any question about your account.
Verified payments, least privilege
Payments run through Razorpay with server-side signature verification — card details never touch our servers, and only organization owners and admins can change plans or billing.
Sessions ride in HttpOnly secure cookies, all endpoints are rate-limited with restricted CORS origins, and want a preview before anything moves? Run a free dry run — it scans, reports, and writes nothing. Security questions or disclosures: support@mysticmatrix.cloud.