Credentials stay on the agent

Migratrix is a cloud control plane plus an agent you deploy. The agent registers over outbound TLS. Database passwords are encrypted on that host. Query results used in the UI are transient and discarded after processing.

If the web app is served over HTTPS, the agent's public URL must be HTTPS or the browser will block it. Bind address (for example 0.0.0.0:4002) is not the same setting as public URL (localhost:4002 in development, or your TLS hostname in production).

This is the claim we will stand behind in a security review. We do not claim SOC 2 on the public site. See the trust center for architecture, data handling, compliance, and operations.