Responsible AI in Data Migration: Our Principles

Principles, Stated as Mechanisms

A principles page is worthless unless each principle names the mechanism that enforces it. “We value safety” commits nobody to anything. So here are ours, each with the thing in the code that makes it true — and, where relevant, the cost we accept to keep it.

1. Your Data Stays Yours

The default provider runs in-process on your machine. No API key, no network call, no telemetry on schema content. Cloud providers exist as an opt-in for people who want them, and opting in is an explicit act.

The cost: our default model is smaller and less capable than a hosted frontier model. We accept that, because for most people in this domain the governance answer matters more than the last few points of quality.

2. Never Silently Wrong

Unconvertible input produces a warning or a gap entry, never quiet plausible output. We hold ourselves to this: when our own transpiler emitted structurally invalid routines for a class of input, the fix was not only the patch but a structural test gate over every fixture, because the real defect was that nothing would have told us.

The cost: a lower headline conversion percentage than we could otherwise claim.

3. Destructive Actions Require a Human

Every operation that writes, drops or truncates stops and names what it will do, to what, on which target. Per action, every time, never generalising from a previous approval. Reads are free, which is what keeps the gate meaningful rather than noise people learn to click through.

4. Everything Is Auditable

Every tool call — arguments, result, whether a human approved it — is written to an append-only log. After an incident, “what actually ran” must be a question with an answer rather than a discussion.

5. No Claims We Cannot Substantiate

We publish the conversion rate because it is measured on a reproducible benchmark that runs on every change. We do not publish end-to-end time savings or ROI multiples, because those depend on inputs only you have — and a number we invented would be worse than no number.

The same rule governs how we write about other tools and other databases: describe situations technically, stay positive about the destinations, and never argue from a competitor’s pricing. If our tool is worth using, it is worth explaining on its own merits.

6. Refusal Is a Valid Output

The system can produce nothing. “This construct has no PostgreSQL equivalent, here is the gap entry” is a better outcome than a confident conversion that compiles and behaves differently. Any system that must always answer will answer wrongly when it doesn’t know.

7. Training Data With Provenance

The model is fine-tuned only on assets we own and generated: our curated knowledge base, our transpiler’s real output, our type-mapping rules, our published writing. No scraped forums, no licensed documentation, and no customer schemas — ever, in any form.