We never see your data. Here is how that is enforced.
Self-hosting moves most of the attack surface to you, which means the questions worth asking are narrow and specific: what does the vendor's code do, how quickly are flaws fixed, and how do you find out. This page answers those, and publishes the advisory log rather than describing it.
What ships switched on.
Two-factor authentication
TOTP for every account and passkeys where the browser supports them, with a policy option to require it for administrators or for everyone.
Encrypted at rest
Gateway keys, SMTP passwords, API tokens and OAuth secrets are encrypted with a key unique to your installation, generated at install and never transmitted.
Least privilege by default
Roles scope every action to own, team or all. Field-level permissions hide salary and personal data. New users start with the narrowest template.
Append-only audit log
Every create, update, delete, login, permission change and export, with old and new values, and no way to delete an entry from the interface.
Session control
Device list per user, remote revoke, configurable idle timeout, rotation on privilege change, and lockout with backoff after failed logins.
GDPR tooling
Subject access export and erasure for an individual contact or employee, consent tracking, and a configurable retention policy on the audit log.
The rule we will not bend
Gyro Suite never deserialises untrusted input. Not from a cookie, not from a form field, not from a URL parameter, not from an uploaded file, not from a queue payload, not anywhere.
This is not a general principle we are quoting. In March 2026 Perfex CRM shipped 3.4.1 to patch an unauthenticated remote code execution caused by insecure deserialisation through a bundled library, affecting most earlier releases of the most widely deployed product in this category. Every codebase has flaws. That particular class of flaw is avoidable by policy, so we made it one, and it is checked in our build pipeline rather than left to reviewer discipline.
How to report something, and what happens next.
| Stage | What happens | Target |
|---|---|---|
| You report it | Through the contact form, topic Press or anything else. Include reproduction steps. PGP key available on request | - |
| We acknowledge | A human replies confirming receipt and giving you a tracking reference | 24 hours |
| We triage | Severity assessed against CVSS, and we tell you our assessment and whether we agree with yours | 3 days |
| We fix | Critical and high severity go out as an emergency patch release. Medium and low go into the next scheduled release | Critical: 7 days |
| We publish | A dated advisory naming the affected versions, the fix version and the impact. Credit to you unless you prefer otherwise | With the patch |
| You are notified | Every installation on an affected version sees a security banner and an update prompt on the Health page | With the patch |
We do not run a paid bug bounty. We do credit reporters publicly by name or handle, we will not threaten anyone acting in good faith, and we will not ask you to sign anything before we accept a report.
Every security advisory, dated.
Nothing to report yet
- Gyro Suite 1.0 was released in 2026 and no security advisory has been issued to date.
- This entry exists so the page is honest about that rather than silent, and so you can see the format an advisory would take.
- An advisory here would carry: affected versions, fixed version, CVSS severity, impact in plain language, whether exploitation was observed, and the reporter's credit.
- Subscribe to the release feed on the changelog page to be notified the moment one is published.
What self-hosting makes your responsibility.
We would rather be direct about this than let you discover it after an incident.
The server itself
Operating system patches, the web server, PHP versions and the hosting account's own security are between you and your host. Choosing a host that patches promptly is the single highest-impact decision you make.
Access hygiene
Strong passwords, two-factor on administrator accounts, removing leavers promptly and not sharing logins. The tools are all in the product; using them is yours.
Testing your backups
Automatic backups run by default. A backup you have never restored is a hypothesis. Test one, once, before you need it, and note how long it took.
Applying updates
We publish them; you click. An installation two years behind on updates is the most likely way this product ever gets compromised, so the Health page nags you and we do not apologise for it.
Found something?
Tell us. We acknowledge every report within 24 hours, we credit reporters, and we will not send you a legal letter.