∀□⟨s,p,o⟩[CLS]∀0x1f⇔λ•—•0x1f[CLS]∀□⟨s,p,o⟩[CLS]•—•0x1f⇔λ•—•⟨s,p,o⟩[CLS]∀□⟨s,p,o⟩λ•—•0x1f⇔λ□⟨s,p,o⟩[CLS]∀□⇔λ•—•0x1f⇔∀□⟨s,p,o⟩[CLS]∀0x1f⇔λ•—•0x1f[CLS]∀□⟨s,p,o⟩[CLS]•—•0x1f⇔λ•—•⟨s,p,o⟩[CLS]∀□⟨s,p,o⟩λ•—•0x1f⇔λ□⟨s,p,o⟩[CLS]∀□⇔λ•—•0x1f⇔∀□⟨s,p,o⟩[CLS]∀0x1f⇔λ•—•0x1f[CLS]∀□⟨s,p,o⟩[CLS]•—•0x1f⇔λ•—•⟨s,p,o⟩[CLS]∀□⟨s,p,o⟩λ•—•0x1f⇔λ□⟨s,p,o⟩[CLS]∀□⇔λ•—•0x1f⇔∀□⟨s,p,o⟩[CLS]∀0x1f⇔λ•—•0x1f[CLS]∀□⟨s,p,o⟩[CLS]•—•0x1f⇔λ•—•⟨s,p,o⟩[CLS]∀□⟨s,p,o⟩λ•—•0x1f⇔λ□⟨s,p,o⟩[CLS]∀□⇔λ•—•0x1f⇔∀□⟨s,p,o⟩[CLS]∀0x1f⇔λ•—•0x1f[CLS]∀□⟨s,p,o⟩[CLS]•—•0x1f⇔λ•—•⟨s,p,o⟩[CLS]∀□⟨s,p,o⟩λ•—•0x1f⇔λ□⟨s,p,o⟩[CLS]∀□⇔λ•—•0x1f⇔

Security

Trust you can verify.

The open-source core runs on your device: your code never leaves your machine, there is no telemetry, and the source is MIT-licensed — you can read exactly what it does.

01 / Data flow

What leaves your machine

For the open-source core, the honest answer is: nothing — unless your AI assistant sends it. There is no graphify server in the loop. Every line below is verifiable in the MIT-licensed source.

Stays on your machine

NOTHING LEAVES

Your source code
Parsed entirely on-device by 36 bundled tree-sitter grammars. No API is called to read or analyze your code.
The parsed graph
Every node and edge is computed and stored locally. Querying it is a local read, not a network request.
The artifacts
Everything graphify writes lands in your repo, in plain formats you can open and inspect:
graph.jsongraph.htmlGRAPH_REPORT.md

What your model provider sees

YOUR API KEYS

Only what your assistant sends
The queries and prompts your AI assistant chooses to send its model — under your API keys, through your provider, on your terms. Graphify adds no channel of its own.
Nothing from graphify itself
The open-source core has no server behind it. It makes no network calls of its own and sends no telemetry — there is nowhere for your data to go.

The MCP server follows the same rule: it runs locally over stdio by default, or as HTTP you self-host — either way, the transport stays inside your infrastructure.

02 / Controls

SOC 2 Type II — in progress

We're working toward SOC 2 Type II for the enterprise offering. No report yet — we'll publish status here as the audit progresses.

Encryption — Enterprise early access

The hosted enterprise layer is being built to TLS 1.3 in transit and AES-256 at rest, part of the Enterprise early-access track. The open-source core needs none of this: it never sends your data anywhere.

SSO & audit logs

SSO via OIDC/JWT — the MCP server speaks OAuth 2.1 with your IdP (Okta, Auth0, Keycloak). No SAML today. Exportable audit logs are part of the Enterprise early-access track.

Self-host / VPC

Run the open-source core air-gapped or in your own VPC. Your ingested data never leaves your infrastructure.

On-device by default

The open-source CLI builds and queries your graph locally. No accounts, no telemetry, no server in the loop.

Data ownership

Your data is yours. Export or delete at any time; we never train on or sell your content.

Report a vulnerability

Found a security issue? We appreciate responsible disclosure and respond within one business day.

founders@graphifylabs.ai