Security
What we touch, and what we keep.
A migration reads your entire customer history out of one system and writes it into another. That is worth a page of specifics rather than a badge, so here are the mechanisms, the subprocessors, and the disclosure most tools leave out.
Handling
How your data is held
OAuth, not pasted credentials
Clarify, HubSpot, Pipedrive and Salesforce all connect over OAuth with scoped, revocable tokens — revoke us from your own admin and we are out, no ticket required. Affinity has no OAuth, so it takes an API key, and an Clarify API key is offered only as a clearly-marked fallback.
Tokens encrypted with a key we do not store beside them
Every credential is sealed under its own data key, which is itself wrapped by a master key held outside the database. One module in the codebase can decrypt, and one table holds token material. A database dump on its own opens nothing.
Background jobs carry an id and nothing else
The durable job that runs your migration receives a single migration id. Credentials and records are fetched inside the job, from encrypted storage, and never travel through a queue payload, a log line or a dashboard. Secrets and personal data are never logged at all.
Every request re-checks who owns the row
Ownership is enforced at the data layer on each request rather than in the page that renders it, and a migration belonging to someone else answers the same way one that does not exist does — so an id cannot be probed for.
Your CSV is deleted when the job finishes
Uploaded files are removed on finalize. What we keep is the structure you approved, the field mapping, the id map and the provenance ledger — the bookkeeping that makes a re-run idempotent and a rollback complete. Not your rows.
Reconnecting to a different Clarify workspace stops the run
Every id we hold is scoped to one workspace. If the connected workspace changes, resume, retry, full-run and rollback are all refused at the door rather than writing this migration's records into somebody else's Clarify.
Model use
What reaches Claude, exactly
Clarify Migrate uses a model to propose your Clarify structure. That is the only place one is involved, and this is the whole of what it receives.
What the model sees
Your answers to the intake questions, and your source system's schema: object names, field names and types, and at most three sample values per field, each truncated to 80 characters. That sample is what lets it tell a pipeline stage from a free-text note.
What the model never sees
The import itself. The structure engine never writes to Clarify and the Clarify writer never calls a model — they are separate paths on purpose. Your records stream from your CRM into Clarify without passing through Claude, whether you are moving fifty rows or five million.
What the model can decide
Nothing, on its own. It proposes a structure and a field mapping; a strict validator rejects anything malformed before you ever see it; and you edit and approve both before a single write reaches Clarify.
Never leaves
Three things that are never migrated anywhere
For any reason, on any plan, at any record count.
Your record rows
Never leavesThe structure engine and the Clarify writer are separate paths. Records stream from your CRM into Clarify without passing through a model.
Your uploaded CSV
Never leavesDeleted on job finalize. What we keep is the structure, the mapping, the id map and the provenance ledger — not your rows.
Credentials
Never leavesSealed under a per-record data key wrapped by a master key held outside the database, and never placed in a job payload, a log line or a dashboard.
Subprocessors
Who else processes it
The full list. Clarify Migrate is operated by Venturise OÜ in Tallinn, Estonia.
Rollback
Getting back to where you were
Cancelling a migration deletes every comment, task, record, relationship and custom object that migration created, in that order, working from a ledger written as each one was made. Anything that was in your workspace beforehand is never touched.
One thing it cannot undo: a field added to one of Clarify's own objects. Clarify publishes a delete for a custom object and for a relationship, and none for a plain field, so a field we added to your company or person object stays. Every one is named by name at the end of the rollback rather than quietly left behind — an empty field is a minute in settings, and a discovery six months later is not.
Read it, forward it, then start with fifty records.
Nothing is written to Clarify until you have approved the structure and the field mapping.