Security
Read-only by default. Approved before anything changes.
Cutover analyzes your applications, data and infrastructure to plan a migration. This page explains how we protect that access, what we never do with it, and what your security team can verify.
Read-only discovery
Analysis reads code, configuration and infrastructure state. It never writes to your live systems.
Pinned sources
Every analysis runs against a fixed commit, so results can be reproduced and checked later.
Named approvals
A named person approves each plan. Approval records the plan hash and the time.
Audit logging
Analysis runs, approvals and changes are logged in an audit trail you can export.
Access and discovery
You choose what Cutover can read. Source access is granted to a specific repository and commit. Infrastructure access is read-only and limited to the resources in scope for the migration. You can revoke either at any time.
- Discovery never deploys, modifies or deletes resources.
- Each analysis is tied to a pinned commit and a recorded configuration snapshot.
- Access credentials are scoped to the migration and can be rotated or removed by your team.
Protecting sensitive data
Sensitive samples, such as HL7 message logs or database extracts, are redacted before any analysis runs. Redaction is required for those inputs and cannot be turned off in the product. Findings are shown as verified (found in code or configuration) or inferred (reasoned from patterns and flagged for review).
- Identifiers are removed from samples before they are analyzed.
- Customer code and data are not used to train models.
- Data residency and storage locations are agreed during discovery and documented in the plan.
Approvals and change control
Nothing reaches your environment until a named approver signs the plan. The approval records who signed, when, and the hash of the exact plan that was approved. Staging can be applied after approval. Production requires a separate, explicit sign-off.
Encryption and infrastructure
Data is encrypted in transit using TLS. Data at rest is encrypted using [encryption standard, e.g. AES-256, to be confirmed]. Key management, network isolation and access controls are described in the architecture review we provide during discovery.
Healthcare and regulated workloads
For healthcare customers handling protected health information, we sign a Business Associate Agreement (BAA) before any such data is processed. For financial, government and other regulated customers, we map the platform's controls to your framework during discovery. Your compliance team confirms the final scope.
Certifications and reports
[Add the certifications and attestations Cutover holds, with report dates, for example SOC 2 Type II. Remove this line if none are held yet.]
Report a security issue
If you believe you have found a vulnerability in Cutover, email ebizmatrix@gmail.com. Please give us a reasonable chance to fix the issue before sharing details publicly. We do not pursue legal action against researchers who act in good faith.