Privacy and legal review

Organizations often put VaultMe through a legal, privacy, procurement, or information security review before a migration goes ahead. This article covers the documentation available for that review and how to obtain what is not published.

Where does a review start?

A review of VaultMe draws on three things: the published Terms of Service and Privacy Policy, the articles in the "Security and privacy" section of this Knowledge Center, and material VaultMe supplies on request. The first two are public and can be forwarded the moment a reviewer asks; the third has to be asked for, and this article is the inventory of what exists.

The fastest way to move a review along is usually to hand the reviewer the articles that answer their questions directly rather than relaying answers yourself. Four articles in this section carry that detail:

• "How VaultMe protects migration data" — the security posture in one place: encryption, where processing runs, how the source and the destination are authorized and how that authorization is revoked, who inside VaultMe can reach customer data, and how incidents are handled.
• "What data VaultMe processes during migration" — which categories of data VaultMe processes during a migration, and which it never touches.
• "Where migration data is stored and how long it is kept" — where migration data is hosted and processed, and how long each category is kept before it is deleted.
• "What VaultMe does not do with customer data" — short, direct answers to what VaultMe will not do with customer data.

Which of these goes to whom depends on who is reviewing. A legal or procurement team usually starts with the Terms of Service and the Privacy Policy and reaches the security articles only for specific commitments. A privacy reviewer normally wants the Privacy Policy alongside the articles on what is processed and how long it is kept. An information security reviewer starts with the security posture article and, if the organization runs a formal vendor assessment, moves on to the materials VaultMe supplies on request.

What does VaultMe publish today?

VaultMe's published material is short and specific:

• Terms of Service — the contractual basis for using VaultMe, at www.vaultme.com/terms.
• Privacy Policy — how VaultMe collects, uses, shares, and retains personal information, at www.vaultme.com/privacy.
• The "Security and privacy" section of this Knowledge Center — customer-facing documentation of how VaultMe handles migration data, written at the depth a security questionnaire asks for.
• VPAT (accessibility conformance report) — at vaultme.com/vpat.pdf.

Nothing else is published. VaultMe does not maintain a trust center, a security whitepaper, or a public compliance portal, and does not publish a SOC 2 report, a Data Processing Addendum, penetration-test summaries, or third-party assessment reports as standalone public artifacts.

Not published is not the same as not available. A substantial set of security and privacy documentation can be requested through support, and a smaller set of things a reviewer may ask for does not exist at all. Those two cases are separated in "What can VaultMe provide for a review?".

Where are the Terms of Service and Privacy Policy?

Both documents live on the VaultMe website, and the published page is always the current version:

• Terms of Service: www.vaultme.com/terms
• Privacy Policy: www.vaultme.com/privacy

The Terms of Service set out the contractual basis for using VaultMe: who may use it, what VaultMe undertakes to deliver, acceptable use, payment terms for paid migrations, and the responsibilities that stay with the customer. Two of those responsibilities surface constantly in migration planning — keeping VaultMe connected to both sides until a run finishes, and making sure the destination has sufficient storage. The Terms also establish that VaultMe acts as a technology provider rather than a cloud storage service and does not take legal possession of customer content at any point, and they cover ownership, warranties and disclaimers, governing law, and dispute resolution.

The Privacy Policy is the longer document and is about personal information rather than migration content. What follows is a map of what it covers, for deciding whether it answers a given question:

• Information collected. What a user provides directly, and the aggregated, non-identifying information collected automatically as the website and app are used.
• Cookies and similar technologies. Which categories are used, what each is for, and how to control them from the browser.
• How information is used and shared. The purposes VaultMe uses personal information for, and the limited circumstances in which it is shared — service providers acting on VaultMe's behalf, and sharing the user has specifically consented to.
• Individual rights. Access and portability, correction of inaccurate information, deletion, withdrawal of consent, objection to processing, and lodging a complaint.
• Retention. How long personal information is kept, and the obligations that can extend that period.
• Age restrictions. Who is eligible to use VaultMe, and how information about children is handled.
• International use. That VaultMe may be accessed from outside the United States, and that information may be stored and processed there.
• Google API data. VaultMe's adherence to the Google API Services User Data Policy, including its Limited Use requirements, for information received from Google APIs.
• Contact and complaints. Where to send a privacy inquiry, a rights request, or a complaint.

The two documents together set the legal framework; the "Security and privacy" section describes how that framework is implemented inside an actual migration. Customer ownership of migrated content, and the limits on what VaultMe may do with it, are established in the Terms of Service and elaborated operationally in the security articles — what VaultMe reads, what it writes, and what it never touches. The Privacy Policy governs personal information handled by VaultMe as a company, which includes analytics on the VaultMe website and app; that analytics activity has no access to migration content and sits outside the migration data-handling rules the security articles describe.

Where are migration security answers documented?

When a questionnaire or a reviewer's email asks a specific question about how migration data is handled, the answer is almost always in one of four articles in this section, and each owns a different part of the ground.

"How VaultMe protects migration data" is the one to send first. It covers encryption in transit and at rest, where migration processing runs, whether VaultMe's backend is reachable from the public Internet, how the source and the destination are authorized and how that authorization is revoked, who inside VaultMe can reach customer data, how much of a migration is automated, which third-party services are involved in running one, how security incidents are detected and reported, and what remains the customer's responsibility.

"What data VaultMe processes during migration" answers what VaultMe actually processes: the content types in scope, the identifiers and metadata handled, the difference between authorization tokens and account passwords, what appears in migration reports and operational logs, what account and billing information is held separately from migration content, and whether customer content is ever used for advertising, analytics, or AI training. It also settles the question that environment-level connections raise: an admin authorization broad enough to reach every account in an environment does not mean VaultMe reads every account.

"Where migration data is stored and how long it is kept" is the article for anything with a number attached. It gives the hosting region, where processing happens, what VaultMe stores in each category, how long each category is kept, what happens when a retention window ends, and whether data can be deleted earlier on request.

"What VaultMe does not do with customer data" is the short one, written as direct answers: whether VaultMe copies or moves content, whether it changes or deletes anything in the source or the destination, whether it reaches accounts outside the migration scope, whether it stores passwords, whether it keeps content past its retention window, and whether it sells customer data or shares it with third parties beyond what running a migration requires.

Which third-party services does VaultMe use?

VaultMe relies on a deliberately small set of third-party services, and migration content flows only through the ones strictly required to host VaultMe and to read from the source and write to the destination.

• Amazon Web Services (AWS). AWS hosts all of VaultMe — the website, the app, the backend components, databases, object storage, monitoring, and key management. Every piece of VaultMe-side storage and processing of customer data happens inside VaultMe's AWS environment, and AWS supplies the compute, networking, encryption at rest, and infrastructure security beneath it.
• Google APIs. VaultMe uses Google's OAuth 2.0 and OpenID Connect implementations to establish connections on the Google side, and Google's Workspace APIs — Gmail, Drive, Calendar, Contacts, and the Directory API where applicable — to read from a Google source and write to a Google destination. Migration content passes through these APIs as part of normal reads and writes.
• Microsoft APIs. VaultMe uses Microsoft's OAuth 2.0 implementation, through Microsoft Entra ID, to establish connections on the Microsoft side, and Microsoft Graph and related Microsoft 365 APIs to read and write. Migration content passes through these APIs in the same way.
• Other provider APIs. For every other supported provider, VaultMe uses that provider's official API or a supported protocol such as IMAP.
• Braintree. Braintree is VaultMe's payment processor for paid migrations. Card details are entered into Braintree's own hosted payment fields and are never stored by VaultMe; Braintree returns a transaction reference that VaultMe keeps with the migration record. Braintree has no access to migration content or migration metadata.
• Analytics tools. The VaultMe website and app use a limited set of analytics tools, such as Google Analytics and Mixpanel, to monitor how the interface itself is used. They collect aggregated signals about interaction with VaultMe's own pages and have no access to migration content, migration metadata, or anything inside the connected accounts. Their use is governed by the Privacy Policy.

In your Outlook to Google Workspace migration, the provider APIs involved are the ones on each side: VaultMe reads from Outlook and writes to Google Workspace, using the official API or supported protocol each one offers.

Two questions usually follow that list. What passes through the source and destination providers during a migration, and where those providers then process or replicate it, is covered in "Where migration data is stored and how long it is kept". What VaultMe does and does not share with anyone beyond them is answered directly in "What VaultMe does not do with customer data".

VaultMe assesses the third-party services it depends on against industry-standard security frameworks and prefers vendors holding a current SOC 2 attestation or its equivalent. A vendor-management policy governs how those services are selected, contracted, and reviewed, and VaultMe's contracts with its infrastructure providers include data-handling and breach-liability provisions.

Can VaultMe support vendor review?

Yes. VaultMe responds to customer-supplied vendor security questionnaires and vendor privacy questionnaires through support. In many cases the HECVAT package VaultMe already maintains — a completed response to the Higher Education Community Vendor Assessment Toolkit — answers what a questionnaire asks, so sending that first can save a round trip.

Every request goes to the same place. Write to support@vaultme.com for a questionnaire response, for the HECVAT package or an individual document from it, for additional security or privacy information, or for custom contractual terms. Support routes the request to the internal contact who owns it.

Reviews that need more than documents can be escalated. VaultMe's CTO, who also acts as its Chief Information Security Officer, and its CEO are the named officers responsible for security and data-handling decisions, and a higher-touch review — a call with the reviewer, an unusual contractual question, a requirement no standard document covers — reaches them through the same request.

When sending a request, name the reviewer and what they need. A questionnaire on the organization's own form, a request for the HECVAT package, and a request for signed contractual terms take different routes once they arrive.

What can VaultMe provide for a review?

The centerpiece of what VaultMe can supply is the HECVAT package. HECVAT — the Higher Education Community Vendor Assessment Toolkit — is itself a comprehensive vendor security and privacy questionnaire, and VaultMe maintains a current, completed response to it. It is not a single PDF: the package is the completed questionnaire workbook together with the supporting addendum documents the workbook refers to.

Those addenda are the documents a security reviewer usually asks for by name:

• Data Flow Diagram and Data Flow Description — how migration data moves between the source, VaultMe, and the destination.
• Information Security Policy — VaultMe's internal security policy.
• Business Continuity Plan and Disaster Recovery Plan — how VaultMe keeps operating through disruption and recovers after a major failure.
• Incident Response Plan — the documented process behind incident detection, containment, investigation, and customer notification.
• Related policy documents referenced from the workbook.

Any one of these can be requested on its own rather than as part of the full package, subject to confidentiality and security review. That is worth doing when a reviewer needs one specific document and not a whole assessment. Beyond the package, VaultMe answers questionnaires supplied on the organization's own form, and is willing to sign appropriate GDPR Standard Contractual Clauses with institutional customers.

The following are not available today, by any route:

• A SOC 2 report or similar third-party attestation. VaultMe has not completed a SOC 2 audit; a first audit is planned.
• A published Data Processing Addendum.
• An ISO 27001 certificate or a comparable formal certification.
• A formal alignment statement against a named industry framework, such as the NIST Cybersecurity Framework, CIS Controls, or ISO 27701.
• Penetration-test or third-party assessment reports.
• A Business Associate Agreement. VaultMe is not designed to process protected health information and does not offer a BAA.
• A PCI-DSS Attestation of Compliance. Payment card data is not stored, processed, or transmitted on VaultMe's own systems; payment processing is handled by Braintree.
• eduGAIN or InCommon federation membership. VaultMe does not participate in either.

If a review treats one of these as mandatory, that has to be resolved on the organization's side — through an exception or a compensating control — because no VaultMe document closes the gap.

Does VaultMe publish SOC 2 or a DPA?

No, on both counts.

VaultMe has not completed a SOC 2 audit and has no SOC 2 report to share; a first audit is planned. There is no equivalent third-party attestation in its place, and VaultMe does not hold ISO 27001 or a comparable certification.

VaultMe does not maintain a standard published Data Processing Addendum. There is no template to download and no pre-signed version to countersign.

Custom contractual terms are a conversation rather than a document. If the organization requires a DPA, specific data-handling clauses, or another agreement before a migration can proceed, write to support@vaultme.com describing what the terms have to cover, and the request is routed to the people who can discuss it. VaultMe is willing to sign appropriate GDPR Standard Contractual Clauses with institutional customers.

If a completed SOC 2 report is a hard gate in the review, raise it at the start rather than at the end. The answer will not change while the review runs, and the organization needs the time to decide how it wants to proceed.

How does VaultMe address privacy laws and data transfers?

The Privacy Policy is the controlling document. VaultMe's position on GDPR, CCPA, PIPL, FERPA, and other applicable privacy laws is set out there, and there is no separate published statement for any individual regulation, so a reviewer asking about a specific law should be pointed at the Privacy Policy rather than at a summary of it.

Underneath the policy, VaultMe processes personal data on behalf of the institutions and customers who run migrations, under data-minimization, purpose-limitation, and retention principles. What those principles mean concretely is documented in this section: "What data VaultMe processes during migration" for what is processed and what is not, and "Where migration data is stored and how long it is kept" for how long each category is kept. VaultMe also maintains a designated Data Protection Officer contact, reachable by writing to support@vaultme.com like everything else in a review.

On international transfers, the shape of the answer is straightforward. VaultMe's own storage and processing are located in the United States, and there is no customer-selectable hosting region; the hosting detail a reviewer will want to cite is in "Where migration data is stored and how long it is kept", and cross-border handling is addressed in the Privacy Policy. A reviewer outside the United States should also know that content passes through the source and destination providers' own APIs during a migration, and where those providers process or replicate it is governed by them rather than by VaultMe — that boundary is covered in "Where migration data is stored and how long it is kept". Where transfer paperwork is required, the contractual route is described in "Does VaultMe publish SOC 2 or a DPA?".

On lawful access, VaultMe does not voluntarily share customer data with law enforcement. Legally binding requests are evaluated case by case, and any disclosure is limited to what is legally required.

What should internal teams receive before a migration?

There is no pre-approved VaultMe packet to request for internal distribution — no briefing document, no review bundle. What exists instead is everything already described above, and it assembles into a packet in a few minutes.

For a review or an internal sign-off, send:

1. The Terms of Service and the Privacy Policy, as the contractual and privacy framework.
2. The four articles in this section — "How VaultMe protects migration data", "What data VaultMe processes during migration", "Where migration data is stored and how long it is kept", and "What VaultMe does not do with customer data" — as the product-specific detail behind that framework.
3. This article, so the reviewer can see directly what is available on request and what does not exist.

For stakeholders who need context rather than a review — a project sponsor, a department head, a colleague who is not running the assessment — "Privacy and security" covers the same ground in less depth and is an easier first read.

Contact VaultMe instead of relying on the articles alone when:

• The reviewer wants answers on the organization's own questionnaire form.
• The organization requires signed contractual terms before the project can start.
• The reviewer asks for the underlying policy documents, such as the Information Security Policy, the Incident Response Plan, the continuity and recovery plans, or the data flow documents.
• A question is specific to the organization's own obligations and is not answered anywhere in this section.
• The review depends on something that does not exist, and the organization has to decide how to proceed.

All of it goes to support@vaultme.com. These requests are handled by people rather than served from a download page, so send them when the review is scheduled rather than when it stalls.