MigrateX is a pipe with a memory of what it has already carried — not a copy of your tenant. This page says exactly what is kept, what is never kept, and how to turn it off.
How access works
- Microsoft 365: a Global Administrator approves the MigrateX app once (admin consent). Application permissions only; certificate credential; no password ever seen.
- Google Workspace: a super administrator delegates the MigrateX service account once (domain-wide delegation). Short-lived tokens minted per call; the admin address is used only for directory calls.
- Exchange Server (on-premises): a service account you create, holding the ApplicationImpersonation role, over Exchange Web Services with Basic or NTLM. Its password is stored encrypted, decrypted only for each EWS call, and never logged or displayed again. HTTPS only; certificate checks can be relaxed per connection and that choice is recorded in the activity log.
- Zoho Mail: one app-specific password per mailbox, uploaded as a CSV and stored encrypted; decrypted only for each IMAP, CardDAV or CalDAV call; never logged or displayed. Every request is pinned to the host you configured. App passwords cannot change Zoho settings.
- Revoke: Entra ID → Enterprise applications → delete MigrateX; remove the client ID from domain-wide delegation; disable the Exchange service account; or delete the app passwords in Zoho. Immediate.
What is kept
| Kept | Why |
|---|---|
| Names, addresses, mailbox and drive sizes | Matching and the assessment |
| Source ID → target ID for every copied item | So nothing is copied twice |
| Progress counters, verification counts, error notes | The tabs and the report |
| OAuth tokens, certificates, TOTP secrets, recovery codes | Encrypted at rest (XSalsa20-Poly1305) |
What is never kept
Message bodies, attachments, file contents, chat messages, tenant passwords. Data streams from source to target in chunks through memory and is never written to disk. Google Drive to Google Drive copies inside Google.
Your MigrateX account
- Two-step sign-in (TOTP) with single-use recovery codes — turn it on under Settings.
- Roles: owner › operator › viewer. Every record is scoped to your organization.
- An append-only audit log of who did what, when and from where — under Activity.
Deleting a project
Overview → Delete this project removes the connections, cursors, item maps and notes. Nothing in either tenant is touched.