We never see your data. Here is how that is enforced.
Self-hosting moves most of the attack surface to you, which means the questions worth asking are narrow and specific: what does the vendor's code do, how quickly are flaws fixed, and how do you find out. This page answers those, and publishes the advisory log rather than describing it.
What ships switched on.
Two-factor authentication
Sign-in with an authenticator app for every account, with a policy option to require it for administrators or for everyone. Passkeys are planned.
Encrypted at rest
Gateway keys, SMTP passwords, API tokens and OAuth secrets are encrypted with a key unique to your installation, generated at install and never transmitted.
Least privilege by default
Roles scope every action to own, team or all. Field-level permissions hide salary and personal data. New users start with the narrowest template.
Append-only audit log
Every create, update, delete, login, permission change and export, with old and new values, and no way to delete an entry from the interface.
Session control
Device list per user, remote revoke, configurable idle timeout, rotation on privilege change, and lockout with backoff after failed logins.
GDPR tooling
Subject access export and erasure for an individual contact or employee, consent tracking, and a configurable retention policy on the audit log.
The rule we will not bend
Gyro Suite never deserialises untrusted input. Not from a cookie, not from a form field, not from a URL parameter, not from an uploaded file, not from a queue payload, not anywhere.
This is not a general principle we are quoting. In March 2026, according to its own release notes, Perfex CRM shipped 3.4.1 to patch an unauthenticated remote code execution caused by insecure deserialisation through a bundled library, affecting most earlier releases of the most widely deployed product in this category. Every codebase has flaws. That particular class of flaw is avoidable by policy, so we made it one, and it is checked in our build pipeline rather than left to reviewer discipline.
How to report something, and what happens next.
| Stage | What happens | Target |
|---|---|---|
| You report it | Through the contact form, under Press, security or anything else. Include reproduction steps. A PGP key is planned | - |
| We acknowledge | A human replies confirming receipt and giving you a tracking reference | 24 hours |
| We triage | Severity assessed against CVSS, and we tell you our assessment and whether we agree with yours | 3 days |
| We fix | Critical and high severity go out as an emergency patch release. Medium and low go into the next scheduled release | Critical: 7 days |
| We publish | A dated advisory naming the affected versions, the fix version and the impact. Credit to you unless you prefer otherwise | With the patch |
| You are notified | Every installation on an affected version sees a security banner and an update prompt on the Health page | With the patch |
The targets above are the ones we will hold ourselves to from the first release. We do not run a paid bug bounty. We do credit reporters publicly by name or handle, we will not threaten anyone acting in good faith, and we will not ask you to sign anything before we accept a report.
Every security advisory, dated.
Nothing to report yet
- Gyro Suite has not been released, so there is no version in the field and no advisory has been issued.
- This entry exists so the page is honest about that rather than silent, and so you can see the format an advisory will take.
- An advisory here would carry: affected versions, fixed version, CVSS severity, impact in plain language, whether exploitation was observed, and the reporter's credit.
- From the first release, every advisory will be listed here and noted on the build log.
What self-hosting makes your responsibility.
We would rather be direct about this than let you discover it after an incident.
The server itself
Operating system patches, the web server, PHP versions and the hosting account's own security are between you and your host. Choosing a host that patches promptly is the single highest-impact decision you make.
Access hygiene
Strong passwords, two-factor on administrator accounts, removing leavers promptly and not sharing logins. The tools are all in the product; using them is yours.
Testing your backups
Automatic backups run by default. A backup you have never restored is a hypothesis. Test one, once, before you need it, and note how long it took.
Applying updates
We publish them; you click. An installation two years behind on updates is the most likely way this product ever gets compromised, so the Health page nags you and we do not apologise for it.
Found something?
Tell us. Security reports are read first, we credit reporters, and we will not send you a legal letter.