Is it safe to transfer files between cloud services?

Moving files between clouds means handing a third-party tool access to your storage — so "is this safe?" is exactly the right question to ask. The honest answer: it depends entirely on the tool, and there are concrete things you can check rather than just hoping. Here's what actually happens under the hood, and how to tell a safe service from a risky one.

What access does a transfer tool actually need?

To copy from cloud A to cloud B, a tool connects to both through their official APIs (OAuth) — you log in on Google's or Microsoft's own screen and grant access; the tool never sees your password. What matters is what the tool actually does with that access. A well-built tool only reads from the source and only writes copies to the destination — and, better still, is built so it can't do more, in code rather than just policy. (Some providers only offer broad scopes, so the consent screen isn't always the whole story — what the tool can do in its code is.)

Copy vs. move: the difference that matters

A "move" deletes from the source after copying — which means if anything goes wrong mid-transfer, you can lose the original. A "copy" leaves your source untouched and only writes to the destination. Copy is strictly safer: your originals are still there if a transfer fails, and you delete them yourself only once you've confirmed everything arrived.

CloudRaft is copy-only by design — it can read your source to make copies, but it has no ability to delete, move, or change anything there. That's enforced in code, not just promised in a policy.

Where do your files go during the transfer?

Some tools download your files to your own computer and re-upload them (slow, but nothing leaves your control). Others run the transfer on their own servers — your files stream through their infrastructure. The thing to check there: do they store your files, or just pass them through? A trustworthy hosted service streams the bytes between the two clouds and never writes your file contents to its own disks.

Five things to check before you trust a tool

1. Copy-only, not move — your source should be untouched. Avoid anything that deletes as it goes.
2. Copy-only, enforced in code — it should only read the source and write copies into a dedicated folder at the destination, never delete or change your originals. Some providers only offer broad scopes (you'll see them on the consent screen), so what matters is what the tool can do in its code, not just what it asks for.
3. No file storage — it should stream files through, not keep copies. Check the privacy policy for exactly what's retained.
4. Where your data is hosted — EU/EEA hosting matters if you're in Europe (GDPR). A real company names its data location and legal entity.
5. Revocable access — you should be able to disconnect the tool any time from your Google/Microsoft account security settings, instantly cutting off access.

Cloud-to-cloud transfers are safe when the tool is built to be — copy-only, least-privilege, no storage, revocable. Check those, and you can move your files with confidence. Ready to pick a route? Box to Dropbox, OneDrive to Google Drive, and every other supported pair work the same way.