We are not a data processor for your content.
ShareShift is worker-only. The application runs on machines you control, authenticates to Microsoft 365 as an app registration you own, and moves content directly from your source to your destination. Nothing of yours passes through our servers.
What our licence server never receives
- ✕File or folder names, paths or URLs
- ✕Document contents, versions or attachments
- ✕User names, email addresses or group memberships
- ✕Permissions, sharing links or metadata values
- ✕Error messages that quote any of the above
- ✕Your Microsoft credentials, certificates or tokens
What it does receive
- ✓Your licence key and which plan it is on
- ✓Each worker machine's name, operating system and ShareShift version
- ✓The destination tenant id the worker is bound to
- ✓Aggregate counters: packages completed and failed, items migrated and failed, bytes moved
- ✓Heartbeats every minute so the lease stays valid
This is enforced in the worker's code, not by policy: the client that talks to the licence server has no access to migration state, and the server's schema has no columns to hold it. The full contract is published in the repository's control plane documentation.
Where your data goes instead
Migration jobs use Microsoft's own SharePoint Migration API and Microsoft Graph. Content is encrypted by the worker with a per-job key and uploaded to Azure storage containers that Microsoft provisions inside your destination tenant. Job state, logs and reports are written to a local folder on the worker.
Authentication
You create the Entra app registration and its certificate. The private key stays on your worker; we never see it and cannot use it. The permissions the app needs, and why, are listed in the setup guide. Consent is granted by your Global Administrator and can be withdrawn at any time from the Entra portal, which stops ShareShift immediately.
For your security review
- Data residency: your content never leaves the Microsoft regions your tenants are in.
- Our licence server holds account details you give us at purchase (name, email, billing via Stripe) and the aggregate figures above. It runs in Microsoft Azure, UK South.
- Licence keys are stored hashed. Worker leases are signed and expire after three days without a heartbeat.
- Every licence action is written to an audit log with the actor that performed it.
- Because there is no processing of your content, no Data Processing Agreement is required for content. Our privacy policy covers the account data we do hold.
Questions for a security questionnaire: shareshift@cameronshields.co.uk.