Security

We never see your data. Here is how that is enforced.

Self-hosting moves most of the attack surface to you, which means the questions worth asking are narrow and specific: what does the vendor's code do, how quickly are flaws fixed, and how do you find out. This page answers those, and publishes the advisory log rather than describing it.

In the product

What ships switched on.

Two-factor authentication

TOTP for every account and passkeys where the browser supports them, with a policy option to require it for administrators or for everyone.

Encrypted at rest

Gateway keys, SMTP passwords, API tokens and OAuth secrets are encrypted with a key unique to your installation, generated at install and never transmitted.

Least privilege by default

Roles scope every action to own, team or all. Field-level permissions hide salary and personal data. New users start with the narrowest template.

Append-only audit log

Every create, update, delete, login, permission change and export, with old and new values, and no way to delete an entry from the interface.

Session control

Device list per user, remote revoke, configurable idle timeout, rotation on privilege change, and lockout with backoff after failed logins.

GDPR tooling

Subject access export and erasure for an individual contact or employee, consent tracking, and a configurable retention policy on the audit log.

The rule we will not bend

Gyro Suite never deserialises untrusted input. Not from a cookie, not from a form field, not from a URL parameter, not from an uploaded file, not from a queue payload, not anywhere.

This is not a general principle we are quoting. In March 2026 Perfex CRM shipped 3.4.1 to patch an unauthenticated remote code execution caused by insecure deserialisation through a bundled library, affecting most earlier releases of the most widely deployed product in this category. Every codebase has flaws. That particular class of flaw is avoidable by policy, so we made it one, and it is checked in our build pipeline rather than left to reviewer discipline.

Disclosure

How to report something, and what happens next.

StageWhat happensTarget
You report itThrough the contact form, topic Press or anything else. Include reproduction steps. PGP key available on request-
We acknowledgeA human replies confirming receipt and giving you a tracking reference24 hours
We triageSeverity assessed against CVSS, and we tell you our assessment and whether we agree with yours3 days
We fixCritical and high severity go out as an emergency patch release. Medium and low go into the next scheduled releaseCritical: 7 days
We publishA dated advisory naming the affected versions, the fix version and the impact. Credit to you unless you prefer otherwiseWith the patch
You are notifiedEvery installation on an affected version sees a security banner and an update prompt on the Health pageWith the patch

We do not run a paid bug bounty. We do credit reporters publicly by name or handle, we will not threaten anyone acting in good faith, and we will not ask you to sign anything before we accept a report.

Advisory log

Every security advisory, dated.

No advisories
as of 9 August 2026
Current

Nothing to report yet

  • Gyro Suite 1.0 was released in 2026 and no security advisory has been issued to date.
  • This entry exists so the page is honest about that rather than silent, and so you can see the format an advisory would take.
  • An advisory here would carry: affected versions, fixed version, CVSS severity, impact in plain language, whether exploitation was observed, and the reporter's credit.
  • Subscribe to the release feed on the changelog page to be notified the moment one is published.
Your side of the line

What self-hosting makes your responsibility.

We would rather be direct about this than let you discover it after an incident.

The server itself

Operating system patches, the web server, PHP versions and the hosting account's own security are between you and your host. Choosing a host that patches promptly is the single highest-impact decision you make.

Access hygiene

Strong passwords, two-factor on administrator accounts, removing leavers promptly and not sharing logins. The tools are all in the product; using them is yours.

Testing your backups

Automatic backups run by default. A backup you have never restored is a hypothesis. Test one, once, before you need it, and note how long it took.

Applying updates

We publish them; you click. An installation two years behind on updates is the most likely way this product ever gets compromised, so the Health page nags you and we do not apologise for it.

Found something?

Tell us. We acknowledge every report within 24 hours, we credit reporters, and we will not send you a legal letter.