Offboarding software that never downloads your files

The question that gets tools blocked

Offboarding runs at the most sensitive moment in a user's lifecycle: their account is being closed, their files are about to be redistributed, and legal hold may apply. Any vendor that downloads or caches file contents during that window inherits a category of risk — data-at-rest in someone else's tenant, retention questions, and a breach surface nobody signed off on.

What metadata-only means in practice

Ownership, permission and sharing data is enough to do the entire job. Deciding who should inherit a file, moving ownership, revoking access — none of it requires reading the bytes. So Votra never requests them.

• File contents are never downloaded, cached, stored, or analysed — by design, not by configuration.
• Ownership and permission changes go through provider APIs in your tenant; data never leaves it.
• Discovery reads resource metadata: what exists, who owns it, who it is shared with.
• The signed export is evidence of actions taken — a record of what changed, not a copy of what was in the files.

Built for the evidence conversation

Every completed operation produces a tamper-evident, signed export: who initiated it, who approved it, what moved, and what failed. That is the artifact an auditor asks for during a SOC 2 examination of your offboarding process — and it is generated from the operation itself rather than reconstructed from email afterwards.

• Separation of duties enforced in the product: the initiator cannot approve their own request.
• Per-item outcome recorded, including failures and skips.
• Evidence export is generated at completion, not assembled later.