The platform

Four things a migration actually needs

Most tools do the first one. The other three are where migrations go wrong, and they are the reason this one exists.

Move it

AI column mapping across engines, with transforms, fixed values and type coercion. Views are first-class sources. What the preview shows is what the runner executes — the same transform engine draws both.

Know before you run it

Preflight samples your real data through your real mapping and forecasts the rows that would be rejected — truncation, type failures, null violations — while it is still cheap to fix them.

Take the whole server

Logins with their hashed passwords and SIDs, Agent jobs, SSIS projects, linked servers. Cygenix reads your target's engine edition first and tells you what will not fit before it tries.

Prove what happened

Ten roles with a real permission matrix, separation of duties, change guardrails enforced on the server, and a hash-chained audit trail that reports a break rather than hiding it.

Intelligent mapping

Drag a column across. Or let the model draw it.

The mapper is a canvas: source columns on the left, target columns on the right, and you join them by dragging one onto the other. The model proposes the joins first and shows the confidence it actually had — not a number invented to look reassuring — so the work is checking suggestions rather than typing four hundred column names.

One transform engine. A CAST to a shorter character type truncates in the preview exactly as SQL Server truncates it on the way in — so a job cannot pass preview and then fail on string-would-be-truncated.
Views as sources. Map from a view the same way you map from a table, with its dependencies resolved.
Evidence, not guesswork. Suggestions are scored on name, type, sampled values and referential shape, and the low-confidence ones are marked for a human rather than quietly accepted. The scoring runs on your machine — the model is sent column names and types, never a value.
Every changed value is counted. A run reports how many values a transform altered, next to the row count.
One-to-many, too. Switch the canvas from Single map to One-to-many and the right-hand side becomes one group per target table, so a single source column can feed several of them at once.
Identity columns refuse the drop rather than accepting it and failing later. Override deliberately, from the table view.

high confidence needs a look low — check it being dragged

Object Mapping — dbo.Customer → dbo.Customer · grid view

Source	Target	Transform	Confidence
customer_id	CustomerID	—	High
full_name	DisplayName	TRIM	High
notes	Notes	CAST → NVARCHAR(100)	Truncates
region_code	Territory	Fixed: N'EMEA'	Fixed
created_ts	CreatedOn	CAST → DATETIME2(3)	High
legacy_ref	— unmapped —	—	Review

6 target columns · 5 mapped · 1 needs review · 2 transforms will change values

Preflight and validation

The failures you find before the run

Preflight pulls a sample of your real rows, pushes them through the mapping you have actually built, and tells you what the target would reject. Validation suites then run any SQL you like, against any table, and report the rows that failed.

Rejection forecast per column — truncation, out-of-range, null-into-not-null, bad conversions.
Your own checks. Point a suite at any table, name the column that holds the SQL, choose which columns appear in the failure report.
Destructive statements are parsed out and listed individually, with whether each one carries a WHERE clause.

Preflight — 5,000 sampled rows

Check	Result	Rows
CheckRowCounts	Pass	—
CheckOrphanRows	Fail	14
CheckDuplicateKeys	Fail	3
CheckNullConstraints	Pass	—
CheckTotalsBalance	Pending	—

FORECAST dbo.Customer.Notes — 3 of 5,000 rows exceed NVARCHAR(100)
FORECAST dbo.Orders.Amount — 1 row fails CAST to DECIMAL(10,2)
CLEAR dbo.Product — no rejections forecast

Schema Explorer

Nine ways to look at an estate
you have never seen before

You inherit a database with four hundred tables, no documentation and the person who built it long gone. Schema Explorer is where you find out what you are actually dealing with — the same estate, drawn nine different ways, from one picker.

Schema map · tables and their keys Data map · a treemap by volume Coverage map · what your saved maps reach Migration map · subject areas Estate map · families as circles Relationship map · a chord of references Radial burst Constellation Globe

Schema map3 direct dependencies · 6 tables one hop out

Follow the keys

Pick a table and the diagram narrows to it — one hop, two hops, or the whole estate. Ask for the shortest join path between two tables and it draws that instead.

No foreign keys? It infers them. Plenty of estates declare none. Cygenix rebuilds the missing relationships from naming evidence and sampled values, and shows the evidence that put each one there.
Trace a field across the estate to see everything that references it.
Exclusion rules hide the drafts, the audit copies and the empty tables, so what is left is the thing you have to migrate.
Load order falls out of the keys: the Coverage map computes dependency waves, and a wave becomes a batch.

Where the data actually is

The Globe reads geography out of the database itself — country columns, region columns, postal codes, foreign keys into your own country table — and stands a bar off the sphere for each region it finds. Height is the volume, log-scaled; colour is the business area contributing most of it.

It reads words, not substrings. Column names are split before they are matched, so BillToCountryCode is geography and RealEstate is not.
Nothing finer than a region count reaches the screen. Every query behind it is a GROUP BY with a COUNT, so no address, client or case can appear on the globe even if one is in the data.
Drill in. World, then a country, then its regions — and a list of what it could not resolve, rather than a silent gap.
Every guess is yours to correct. Each detected column shows the evidence that classified it and can be overridden. A silently wrong map is worse than an editable one.

Server migration Beta

The objects most tools leave behind

Schema and data are half a migration. Logins, Agent jobs, SSIS projects, linked servers and credentials live at the server level, and almost everything else either ignores them or hands you a script to run by hand.

Logins move intact — the hashed password and the SID travel, so orphaned users do not appear on the other side. Passwords held by a remote server are never read and never moved.
It checks the target first. Cygenix reads the engine edition and tells you what that target cannot hold — before it starts, not at the first failing statement.
Named equivalents, not a shrug. Where an object has no home on the target, the panel names the Azure construct that replaces it.

Server Migration — target assessment

Target reports: SQL Azure. Azure SQL Database holds no server-level objects at all. Nothing in this module can move to it — the equivalents below are Azure constructs you create yourself.

Object class	Verdict	Equivalent
Server logins	Needs equivalent	Contained database users
Server roles	Needs equivalent	Database roles
SQL Agent jobs	Needs equivalent	Elastic Jobs, or Automation
SSIS projects	Needs equivalent	Azure-SSIS IR, or Data Factory
Linked servers	Needs equivalent	External data sources
Credentials, proxies	Not possible	—

Proceed — disabled nothing here can move to this target

Governance

Controls that the interface cannot talk its way past

A confirmation dialog is not a control if skipping the dialog skips the control. Everything here is decided on the server, and a refusal is recorded as carefully as a permission.

Users & Roles — change guardrails

confirm-destructive ✓ Two-person rule

A DELETE, TRUNCATE, DROP or unbounded UPDATE is queued until somebody other than the requester approves it. Applies to PROD and STAGING — an unclassified connection counts as PROD.

Awaiting approval

DELETE FROM dbo.Orders

no WHERE

Approve

requested 2 minutes ago · expires in 13 · you cannot approve your own

Shared workspaces. Projects belong to the workspace, not to whoever created them, and colleagues join by invitation — named with the roles they will hold, and admitted the first time they sign in. There is no step in an identity provider's admin console.
Change guardrails. Confirm destructive changes, or every change. Enforced against a hash of the exact statement, so an approval cannot be replayed, moved to another target, or survive an edit to the SQL.
A two-person rule. Turn it on and a gated change waits for a second person. Nobody approves their own request, and the sole approver of a change cannot be the one who executes it.
Ten roles, one matrix. Owner, Administrator, Lead, Engineer, Approver, Data Owner, Validator, Auditor, Member, Automation. Deny by default: an action nobody has been granted is refused to everybody, administrators included.
A tamper-evident audit trail. Hash-chained and append-only, with an endpoint that re-walks the whole chain and names the entry where a break starts. Every gated action and every refusal is in it.

Automation

Packages, schedules, and a resume that means it

Group jobs into a package, save it, load it back and run it. Or hand it to the Task Agent and walk away — it runs on a cadence, after another job, or at a time you pick, and emails you when it is done.

Packages respect dependency order, so a child table never loads before its parent.
Task Agent runs conversions, validation suites, reindexes, reports and custom SQL on a schedule.
Resume picks up from the last committed checkpoint rather than starting the whole job again.
Two modes. AI-assisted keeps you deciding at each step. Agentive plans and executes the whole job while you supervise. Both stop when you tell them to.Agentive: beta

Package — nightly load · 4 groups

Group	Job	State
1	dbo.Product	Complete
1	dbo.Customer	Complete
2	dbo.CustomerAddress	Complete
3	dbo.Orders	Running · 62%
4	dbo.OrderLine	Queued

22:00:04 batch started · 27 jobs
22:06:41 transient timeout on dbo.Orders — retrying (1/3)
22:06:58 resumed from checkpoint · 412,000 rows committed

Data Stream Preview

Keep the old system running while the new one fills up

A big-bang cutover is a decision most teams would rather not make. Data Stream is continuous capture and delivery — capture from the source, a stream store in the middle, delivery to the target, with lag, backlog and dead letters visible per stream. In preview, running on sample data while the live connectors are finished.

Capture

Per-object capture with a checkpoint and a key column, started and paused independently.

Stream store

A retained middle with per-topic depth, so a slow target does not lose events.

Monitor

Lag, throughput, dead letters and alerts per stream — with a replay for anything held back.

Security

Where your data goes, named place by place

Migrating a database means reading it, so your rows pass through Cygenix on the way to your target. What follows is where they go, what is kept afterwards, and the two places a literal value from your data can come to rest. No certification stands behind any of it. What stands behind it is a mechanism you can check.

The data path

Four classes, because they have four different answers. The distinction that matters is between data we move and data we keep: almost everything we keep is derived from your data rather than taken from it.

Classes of data, where each one lives, and for how long
Class	What it is	Where it lives	Control
In flight	Rows read from your source, transformed, and written to your target	Memory of the function running the batch	Never written to disk by us, and gone when the batch ends
Derived	Schema metadata, column mappings, row counts, confidence scores, conversion reports, job history	Azure Cosmos DB, UK South	Aggregates and structure. The Globe view is the rule in miniature — it asks for a `GROUP BY … COUNT` and stores the count
Incidental	Values that reach a driver error message, and the examples a preflight keeps	Your browser; error text also reaches our operational logs	The one place literals land. Named in full below
Retained by design	Nothing today	—	Data Stream is the module that would hold rows. It runs on seeded demonstration data and has no connection to a real database or broker

What we store

Table, column, type and key structure
Your column mappings and transforms
Row counts, forecasts and confidence scores
Conversion reports and job history
The audit chain: who did what, where, and whether it was allowed
Connection strings for scheduled jobs only — see Credentials

What we do not store

The rows themselves, at any point after a run
The SQL text of any statement, in the audit trail or anywhere else
Sample values in a mapping, a report or an inferred relationship
Anything at all in the Data Stream store
Your Anthropic API key, which never leaves your browser

Sampling

The product reads real values in five places. This is what each one does with them afterwards, including the one that keeps them.

Preflight keeps examples, in your browser. A forecast holds up to three offending values per rejecting column, each cut to 60 characters, so you can see what would break rather than a count that means nothing. That report is saved in your browser and is not synced to us. It is the only place in the product where a literal value is deliberately retained.
AI mapping never sees a value. The request goes from your browser straight to Anthropic on your API key, and carries column names and types. It does not pass through Cygenix, and no row value is in it. The scoring that does use sampled values — containment, orphan rate, cardinality — runs on your machine.
Inferred relationships keep the arithmetic, not the values. Rebuilding a missing foreign key means testing whether one column's values are contained in another's. What is stored is the match rate, the orphan rate and the cardinality — the evidence, not the rows it was computed from.
Error messages can quote a value, and are not redacted. A failed type conversion usually names the value that failed. You see that text, and it reaches our operational logs. There is no redaction rule today. We would rather say so than have you find out from a log.
Data Stream holds nothing. The module that would retain a middle and a dead-letter queue runs entirely on seeded demonstration data. Preview

The rule underneath all of it: nothing finer than an aggregate reaches storage unless a person asked for it — and the one place where a person did is the first item on this list.

Credentials

The honest summary is that credential handling is the weakest part of this list, and the strongest thing we can offer is a way to avoid having a credential at all.

Use Entra ID and there is no password to hold. Where your databases accept Microsoft Entra authentication, Cygenix uses it and no SQL password is stored anywhere — not in your browser, not by us.
Otherwise the connection string stays in your browser — in session storage, cleared when the tab closes. It is held in plain text, which means any script running on the page can read it. Treating that as solved would be untrue.
Scheduling a job is the exception, and it has to be. A job that runs at 2am with no browser open must read the connection string from somewhere, so scheduling stores it on our side, in Cosmos DB. If that is not acceptable for a given database, run it interactively or use Entra.
Connections out to your databases obey your connection string. Certificate validation can be turned off in it, and for a PostgreSQL host we do not recognise as a managed provider the default is no TLS at all. Set sslmode if that matters — the product will not quietly upgrade it for you.
Passwords held by a remote server are never read. Migrating logins moves the password hash and the SID, so accounts work on the target without anyone ever holding the password itself. What cannot travel — credentials and Agent proxies to Azure SQL Database — is refused with the reason, not silently dropped.

Enforcement

The governance controls above this section are worth one more paragraph here, because the question a reviewer asks is not what they do but where they run. They run on the server. The role matrix, the environment classification, the guardrails and the two-person rule are evaluated before the statement executes, so a modified client, a direct call to the API or a replayed request meets the same refusal as the button would have. An approval is bound to a hash of the exact statement it approved: it cannot be replayed, pointed at another target, or survive an edit to the SQL. The governance section has the substance.

Audit

Most audit trails answer "has this been tampered with?" with yes or no. This one re-walks the chain and names the entry where a break starts, which is the difference between knowing something is wrong and knowing where to look.

Audit — chain verification

Verified chain verified · 1,204 entries intact

1204	sql.write	dbo.Orders · PROD	allowed
1203	sql.write	dbo.Orders · PROD	denied

If a chain were broken

Break found broken at entry 862 · entry hash mismatch

Entries 1 to 861 verify. The report names the sequence number and which of the two checks failed — a previous-hash mismatch means an entry was removed, an entry-hash mismatch means one was altered.

Hash-chained and append-only. Each entry carries the hash of the one before it, so removing or editing an entry breaks every hash after it.
An entry is twelve fields, and none of them is your SQL. Sequence, time, who, their roles, the action, the resource type, the connection it touched, its environment, the outcome, a severity and a reason. The resource is a server and database name. No statement text and no column values are written, so a secret in a literal cannot land there.
Refusals are recorded as carefully as permissions. A denial carries the reason and the roles that were held at the time, which is the half of an audit trail that usually goes missing.
And one limit, stated rather than buried. The store has no transactions, so two appends at the same instant can race for the head of the chain. A retry closes the realistic window, and verification reports a break rather than hiding one. We describe it as tamper-evident, not tamper-proof, and that word is chosen.

Assurance

The block that makes the rest of this worth reading. Here is the state of each control area, including the ones that are not finished.

Control areas and their current state
Control area	State	What that means
Identity	In place	Microsoft Entra External ID. Tokens verified server-side against Microsoft's published keys on every request
Authorisation	In place	Ten roles, a permission matrix as data, deny by default, evaluated on the server
Audit trail	In place	Hash-chained, append-only, with the verification endpoint above and the limit named beside it
Encryption at rest	In place	Azure-managed keys on Cosmos DB and Blob Storage. Customer-managed keys are not offered — there is no key vault
Transport to Cygenix	In place	HTTPS only, HSTS, and the usual content-type, framing and referrer headers
Transport to your databases	Your setting	Governed by the connection string you supply, including whether certificates are validated. See Credentials
Credential storage	Known weakness	Plain text in browser session storage for interactive work; server-side for scheduled jobs. Entra avoids it entirely
Log redaction	Not built	A driver error can quote the value that caused it, and nothing strips it today
Penetration test	Not done	No third party has tested this system
Certification	None held	No ISO 27001, no SOC 2, no Cyber Essentials — see below

Cygenix holds no security certification. Not ISO 27001, not SOC 2, not Cyber Essentials, and none is in progress with a date we could quote you. Saying otherwise, or implying it with a badge, would be the first thing in this section you could not check.

What exists instead is available now: the architecture written down as built, an internal audit of exactly the questions on this page, a security questionnaire completed honestly rather than aspirationally, and a call with the engineer who wrote the code — which is the same person either way.

A certificate is a statement about process, and it will come. Everything above it is a mechanism, and you can check those today. Reporting a vulnerability · security@cygenix.co.uk

Configurator and Project Plan

Scope it, price it, then plan it —
without leaving the tool

Two screens that most migration tools leave to a spreadsheet. The Configurator turns scope into days and a delivery date; the Project Plan turns that estimate into a grid you can hand to a client.

Configurator · effort modeltick a module in or out · the weights are yours

An estimate you can argue with

Seven standard use cases, your own module list, a complexity weight on each, and project variables on top. Every macro from the spreadsheet this replaces is a formula printed on the page — so when a client asks why the number is what it is, there is an answer.

Function points to a date. Points become working days, days become calendar months, and the delivery date walks forward over your working week and your holidays.
A verdict, not just a total. It compares the days needed against the days available before the client's due date and says whether it fits.
Weights can be negative. A variable may reduce effort as well as add it — with a floor, because effort can be cut and never erased.
Calibrate to your own quote. Tune the model so a full-scope estimate lands exactly on your standard price, and partial scopes then price proportionally inside it.
Save house defaults so every new estimate starts with your firm's weights, not ours. Export as CSV or JSON.

A plan you paint

Phases down the side, a month-by-week timeline across the top. Choose a tool and drag across the weeks to lay in work or stand up a milestone. It is not a Gantt chart pretending to be a project manager — it is a grid, and the grid is the report.

Built from the estimate in one click. Each costed use case becomes a phase, its modules become the task's detail, and the work bars paint themselves at the model's own rates. The delivery date and the client's due date land as milestones.
A copy, not a link. The import happens once and the plan is yours to edit — an estimate that silently rewrote your plan would be worse than no import at all.
Portfolio view. Every project on one timeline, by project or by resource — and where somebody is booked on two projects in the same week, that week is hatched.
Out as CSV, Excel or print, with the phase colours, bars and milestones intact.

Project Plan · phase gridpaint · milestone · erase

Reporting and insight

Something to send upstairs, not just a log file

Build interactive dashboards over the source or target with drag-and-drop charts, generate an executive summary in plain English, and ask questions of the schema without writing SQL first.

BI dashboards over either database, saved with the project.
Conversion reports and executive summaries written from the run's own record, exportable to Excel.
Plain-English questions — what a table is for, what depends on it, what would break if it changed.
Scope and plan — the Configurator and the Project Plan, above.

Reports — conversion summary

ROWS MOVED

1,284,902

REJECTED

17

TABLES

42 / 42

Summary. All 42 tables loaded. 17 rows were rejected, all on dbo.Customer.Notes, where the source value exceeds the target length. The mapping now truncates explicitly; a re-run of the affected batch is recommended before sign-off.

What it supports

Exactly what it connects to

Cygenix keeps one capability manifest that the product and this page both answer to, so every engine named here is one the code connects to today. The full matrix — every source, target, combination and server-object class — lives in the documentation.

Source	Status	Notes
SQL Server	Available	2012 and later, on-premises or hosted. Tables and views.
Azure SQL Database	Available	Entra or SQL authentication.
Azure SQL Managed Instance	Beta	Including the server-level objects a Managed Instance can hold.
PostgreSQL	Available	As a source and as a target.
Files	Available	CSV, Excel and delimited text, with schema inference.
Azure Blob Storage	Available	Your own container, reached with a SAS you supply.

Targets: SQL Server, Azure SQL Database, Azure SQL Managed Instance and PostgreSQL. Twelve source-to-target combinations are supported; the matrix in the documentation says which, and what changes when the engines differ.

Migrate the database. Prove it moved.