Client-side by design
Every tool on Data Migration Tools runs entirely in your browser. The data you paste, upload, or generate is processed by JavaScript on your machine and never sent to our servers.
This is the single most important security property of the site: there is no server-side data store for your tool data.
What we do not receive
- File contents you upload to any tool.
- Text you paste into any converter, scanner, validator, or decoder.
- Your JWTs, secrets, or API keys.
- Your CSV, JSON, XML, or YAML data.
The one exception: the migration agent
When you ask the migration agent for an assessment, your text query (not file contents) is sent to our /api/agent endpoint. The endpoint:
- Verifies a Cloudflare Turnstile token (if configured) to prevent abuse.
- Rate-limits per IP (10 requests/minute).
- Sends the text to an LLM (Anthropic) to extract structured slots.
- Runs the deterministic engine with those slots.
- Returns the assessment. Your query is not stored.
Security headers
This site sends the following security headers where supported by the hosting platform:
Content-Security-Policy— restricts what scripts and styles can run.X-Content-Type-Options: nosniffReferrer-Policy: strict-origin-when-cross-originPermissions-Policy— denies access to camera, microphone, geolocation.
Responsible disclosure
Found a security issue? Email security@data-migration-tools.com. We will acknowledge within 48 hours and work with you on a fix.
What we are not
We are not a SOC 2, ISO 27001, or HIPAA-certified vendor. We are a free, client-side toolkit. If you need enterprise-grade compliance certifications for a vendor, this is not that — and we will not pretend otherwise.
Last updated: August 2026.