TransferMyHost
← Back to TransferMyHost

Security architecture

How the TransferMyHost migration design protects credentials and separates migration work from billing and account management.

This page describes the platform’s security design. It is not a certification, penetration-test report or claim that every deployment has been independently audited.

Separate website, application and workers

The marketing website has no access to migration credentials, payment details or application accounts. The TransferMyHost app manages authorisation and migration state; dedicated workers execute transfers. WHMCS requests and follows work through the API instead of running account transfers itself.

The credential lifecycle

  1. Authorised input. The customer supplies access details through the app or its authorised integration, for an account they have permission to migrate.
  2. Encrypted storage. Sensitive migration credentials are encrypted before storage.
  3. Assigned access. A worker receives credentials only when assigned an authorised migration job.
  4. Limited retention. Migration credentials are removed after completion or expiry.

Logs and operational access

Passwords and API tokens are excluded from normal logs. Migration logs are intended to describe progress and results without exposing reusable access details. Credentials should never be pasted into tickets or diagnostic messages.

Worker isolation

Workers carry out assigned migration tasks. They do not receive access to customer billing or account-management data. The platform coordinates jobs and returns the result to the customer or integration.

Encrypted communication

Platform and worker communication uses HTTPS. Source and destination access must also be configured securely. Prefer appropriately scoped API tokens where supported, and remove temporary access when it is no longer needed.

Website protections

This site uses locally hosted assets and a restrictive Content Security Policy. It contains no credential form, account session or payment processor. The production deployment configuration redirects to canonical HTTPS and sets security headers.

Reporting a security concern

Email support@transfermyhost.com with a description, affected URL and non-sensitive reproduction steps. Do not include live passwords, API keys or customer data. Contact us before sharing sensitive evidence so we can agree a suitable channel.