Security, built into how it works.
You're granting CloudRaft access to your cloud. So we built it to hold as little of your data as possible, for as short a time as possible — and to never do more than copy.
Copy-only, always
We only ever read your files and write copies. CloudRaft never deletes, moves, renames, or modifies anything in your source cloud — it's enforced in code, not just policy.
Your files are never stored
Files stream straight from one cloud to the other through our worker and are never written to our disks. The only thing we keep afterward is the file's name, size, and copy status.
Credentials encrypted at rest
The credentials we hold — sign-in tokens for your connected accounts — are encrypted at rest. We never see or ask for your actual account password.
Least access we can ask for
Where a provider offers a narrow scope, we take it — we reach only the files you pick and the copies we write. We're upfront about each provider's access on the privacy page.
Hosted in the EU
Your account, file metadata, and encrypted credentials are hosted in the European Union (Amsterdam). Your file contents only ever pass through in transit.
No ad tracking
No ad pixels, no fingerprinting, no profiling, no data brokers. We use Google Analytics for basic traffic counts — only after you accept the cookie banner, and never for advertising. Decline and analytics stays cookieless.
How we guarantee CloudRaft never touches your originals
“Copy-only” isn't a promise we ask you to take on faith — it's built into how CloudRaft works, in three layers, from the most fundamental to the most verifiable.
1. We only ask for read access to your source.
When you connect the cloud you're moving from, CloudRaft requests read-onlypermission (for example, Google's read-only Drive scope, OneDrive's Files.Read). It is not technically capable of changing anything in your source, because it never holds write permission there in the first place. The destination — the cloud you're moving to — is the only place CloudRaft writes, and there it only ever adds copies.
2. There is no “delete” or “modify” in the code.
The part of CloudRaft that talks to your source cloud has no delete, move, rename, or overwrite functions at all — they simply don't exist in it. This isn't a setting that's switched off; it's a capability that was never built. If an engineer tried to add a line of code that modified a source file, the project wouldn't even compile. The guarantee is enforced by the structure of the software, not by policy.
3. Your files are never stored on our servers.
Your files stream through our servers directly to the destination and are never written to our disks. We keep only the filename, size, and status — enough to show you progress and verify the copy — and nothing else. Hosted in the EU (Amsterdam), with no ad tracking.
What this means for you:the worst thing that can happen in any failure — a dropped connection, a server restart, anything — is that you run the migration again. Your originals are exactly where you left them, every time. That's why we can say it plainly: we have never modified a single original file, and the software can't.
Copy-only is the whole point
Every other promise rests on this one: CloudRaft reads your source files and writes copies into the destination you choose. It has no code path that deletes, overwrites, renames, or moves anything in your original cloud. If a transfer is interrupted, it resumes where it left off, and every file is verified before it's marked done — checked by size, and by checksum where the provider supports one.
We don't keep your files
Your file contents are never written to our storage. They stream from the source cloud, through our worker's memory, to the destination — and they're gone from our side the moment the copy lands. What remains is the minimum we need to show you progress and resume safely: each file's name, size, and status.
How your credentials are protected
The tokens that let us reach your clouds, and any app password you create for a self-hosted server, are encrypted at rest. We never see your provider account password — sign-in happens on the provider's own screen. When you disconnect a cloud or delete your account, we delete the credentials we hold and ask the provider to revoke our access.
You stay in control
Disconnect any cloud from Settings at any time. Delete your account and we remove your stored data and ask each provider to revoke our access. OneDrive is the exception — Microsoft doesn't support revoking from our side, so to cut access there, remove CloudRaft from your Microsoft account's connected apps. For a self-hosted server, revoke the app password on your own server.
Reporting a vulnerability
Found something? We want to hear about it. See our security.txt for how to reach us, or email support@cloudraft.app. No paid bounty yet, but we'll publicly credit responsible reporters if they'd like.
The full detail — exactly what we store, who processes it, and how to delete it — is in our Privacy policy.
Who operates CloudRaft
CloudRaft is built and operated by Robinson Holding AS, a registered Norwegian company (org.nr 927 250 861 · verify in the Norwegian business register ↗), based in Stavanger, Norway (EEA). All processing is EU-hosted.