01
Analyst: local analysis
Core discovery, profiling, sensitivity scanning and reporting process data locally. The dashboard binds to loopback. Local account and role storage is the default.
Product security · reviewed October 2026
Your environment.
Explicit data flows.
Core Analyst analysis runs locally without telemetry. Optional integrations are explicitly configured. Execution and reconciliation have their own permissions and storage requirements.
Controls that match the product.
02
Analyst: encrypted samples
Representative samples can persist in encrypted local caches and a per-run sample vault. On Windows, the default key is wrapped for the current user. Purge controls remove retained samples; key backups require secure handling.
03
Explicit optional integrations
Per-project LLM-assisted domain naming sends domain groupings, table names and relationship structure, not row data or credentials. Shared SQL Server findings storage is opt-in. Vault credential resolution is enabled per configured field.
04
Framework: execution access
Target loading requires write permissions. CDC needs database logging, connector accounts and infrastructure permissions. Scope identities to the chosen path and protect staging, Kafka, control databases and logs within your environment.
05
Recon Sentinel: read-only checks
A statement guard limits database checks to read-only SELECTs. Results retain counts, pass/fail, deltas and keyed digests, not raw sensitive values. Authorised leads can locate real keys on screen.
06
Accounts and audit evidence
Product roles restrict privileged actions. Recon Sentinel has a verifiable hash-chained audit trail and hashed sign-off packages, with separate technical and business approvers.
Sensitive-field detection supports review.
Analyst flags fields likely to contain personal, payment or health information using schema and sample patterns. These findings guide masking, access and governance decisions; they do not establish GDPR, HIPAA or PCI compliance.
Use scoped read-only identities for Analyst and reconciliation, minimise samples and review retention. Framework execution needs additional permissions appropriate to the load and CDC path.
Website and release readiness.
This website is separate from the migration tools. It uses Vercel hosting and analytics, and Resend for enquiry delivery. Optional product integrations have their own explicitly configured data flows.
Independent security certifications are not currently claimed. Confirm release readiness, deployment requirements and support commitments during pilot scoping.
Report a security concern to security@3csconsulting.com.au.
Review security against your migration scope.
Discuss data flows, retention, credentials and the permissions needed by each product.