A look inside that changes nothing
Before a deal closes, a company lets you look inside its clouds. TenantShuttle is built so that look is read-only by construction, limited to what its administrators granted, and kept on your side.
Reads only, checked every time
Every request is checked against a reviewed list of read operations before it is sent. A request that is not on the list is refused on your computer and never reaches the cloud.
Proven in a lab
Each cloud is verified against a lab set up the way a customer's would be. The clouds' own audit logs show no change made by a collection, and no secret planted in the lab appears in any output.
Access the company grants
The access request is a set of scripts the company's administrators read and run themselves. It asks for read and list permissions only, worked out from the reads TenantShuttle makes, and they can take it back at any time.
Your key stays with you
On Azure, TenantShuttle signs in as an application, preferably with a certificate: the company receives only its public half, and the private key never leaves your computer. On AWS, it takes on a read-only role the company creates, with an external ID.
No secrets kept
Settings are recorded; secret values are not. Lists that could return a secret are never asked for, each one skipped is listed with the reason, and anything named like a read of secrets or data is refused.
Encrypted projects
Everything a collection reads is kept in a project encrypted on your computer, with a key of its own held in the computer's secret store or behind a passphrase. The complete export and move plans are encrypted the same way, and reports can be.
Nothing comes to us
TenantShuttle runs on your computer and never sends what it reads, or how it is used, to us. It does not call home.
Name checks only when asked
Checking whether a proposed name is free in a cloud is optional. When it is turned on, it asks the cloud's public endpoint about that name only, anonymously, and the plan records each question and answer.
Changes only with approval
A move plan holds anything that would overwrite or merge until a named person approves that item, after reading what exists, what will change and what cannot be undone. How moves work.
What is yours to look after
Because TenantShuttle runs on your computer, the projects it makes are in your care: keep the computer up to date and its disk encrypted, keep the project passphrase or key somewhere safe and apart from the projects, and share exports only with the people the deal allows. When the company takes the access back at the end of the work, collections stop; the projects you made stay readable to you.
What we hold about you
Only the email you send us when you ask for access or for help. See the privacy notice.
Reporting a vulnerability
If you find a security problem in TenantShuttle, please write to [email protected] with the details, and give us a reasonable time to fix it before you tell anyone else. We will acknowledge your report and tell you what we do about it.