My company manages many Magento stores for our clients. Most things we do in-house, but migrating 100+ stores to 2.x on our own would take a lot of manhours, so we'd like to test some 3rd party vendors and see if they can do a quality job with less cost.
How can we prevent the PII from those stores leaking into the wrong hands?
We've never had to give a 3rd party access to the store database, so we've never faced this problem and aren't sure how to handle it.
We've thrown around ideas like:
- Anonymize the data first, let the 3rd party write the migration mappings, but run the migration script ourselves
not ideal; still lots of work for us; migrations might not actually work
- Encrypt all the customer data first, then decrypt it in the Magento 2 DB when we receive it.
Still lots of work, plus requires modifying DB to accommodate the longer, encrypted versions of those strings, will require 3rd party to understand what's happening there and apply the same schema change
- Anonymize the data first, then once we get the finished M2 DB back, write scripts to update those anonymized strings with data from the original M1 DB
I don't know if this can even work. Also seems like a lot of work: Basically like re-migrating.
How do you prepare for this sort of scenario?
Clarification, in response to comments:
3rd party: refers to a company who offers a paid service to migrate your Magento 1 store to Magento 2. Just Google for "Magento 2 migration service" and you'll see what I mean.
Who we are: We're not re-selling a migration service. We manage many stores as a turn-key solution we provide to clients. They ship us merchandise in bulk, then we handle all the logistics of getting it sold online, and send them a check for their profits. Many of them don't even know what Magento is, much less what version their store uses.