GyreDownload
ProductPricingChangelogDocsSecurityDownload

Security and privacy

Your code never leaves your machine unless a feature you use requires it, and then Gyre shows you what is sent and where before it goes.

Local by default

Gyre is an editor plus gyred, a local engine that runs on your computer. Indexing, log parsing, stack-trace mapping, timelines and AI orchestration happen there. Timelines are stored in a local SQLite database.

  • The editor talks to gyred over a Unix socket or Windows named pipe in a directory only your user can read, with a token handshake on every start.
  • Gyre talks to your providers (code host, CI, deploy platform, error tracker) directly from your machine, with your credentials.
  • Fix branches are built in a private index and pushed with your own git. Your working copy is never touched.

Tokens and keys

  • Provider tokens and AI keys are stored in the OS keychain: macOS Keychain, Windows Credential Manager or Secret Service on Linux.
  • The engine can set, check and delete credentials, but never return them over its interface.
  • Tokens are checked with the provider when you add them, and a revoked token shows as disconnected.

AI requests

Gyre has no AI service of its own. AI features use your own Anthropic or OpenAI key, or the Claude Code CLI you already use.

  • Every request is previewed first: the exact text, its size and its destination. What is sent is exactly what you saw.
  • A keep-code-local policy setting turns off features that would send code.
  • Claude Code runs in a fresh private folder for each call.

Teams and Gyre Cloud

Joining a team is opt-in, with a consent dialog that says what is shared. Team sync sends metadata, not source code: branch names, commit ids and the events on each timeline (pipelines, reviews, deploys).

  • Gyre Cloud runs at api.gyreapp.io over HTTPS only, with HSTS.
  • Device sessions are stored hashed. Team secrets are encrypted with AES-256-GCM under a master key.
  • Team tokens are checked and sealed when added, and never returned to any client.
  • Webhook signatures are verified in constant time; replays outside a 5-minute window are refused.
  • Single sign-on uses OpenID Connect with PKCE. Each login is bound to the device that started it by a one-time code.
  • The server only calls public HTTPS hosts, and every response blocks framing and MIME sniffing.

Self-hosting

Gyre Server is the same server as Gyre Cloud, packaged for Docker Compose and Kubernetes (Helm). Run it inside your network with your own Postgres (over verified TLS) and your own master key, and your team data never reaches us.

The editor

  • Gyre is built on Code - OSS. Telemetry is off by default.
  • Extensions come from Open VSX, not the Visual Studio Marketplace.
  • No Microsoft-proprietary extensions are bundled.

Report a problem

Found a vulnerability? Email hello@gyreapp.io with the details. Please give us a chance to fix it before you share it.