Security

Your code runs on your machine and never leaves it. That is true of every configuration of toryo and always will be. We do not host your source, we do not proxy your model traffic, and we do not hold a copy of what your agents read or write.

There are two shapes to the rest of it. By default, everything except licensing and crash reports is local: the knowledge your agents build up lives in Postgres on your own machine and we hold no copy of it. When toryo itself crashes it sends us a report of its own failure: its own stack, the error message with secrets redacted and paths collapsed, and which command failed. The report has no field for your environment, your keys, or the bodies of what toryo sent and received. Its one free text is the message, which is whatever the failing code put in it, so it can quote a fragment of what toryo was processing. That is what the redaction, the path collapse and a 500-character cap are for. You can turn that off, and the privacy notice lists exactly what one contains.

A team can instead choose a shared knowledge plane so their agents learn from one another, which does put that knowledge on infrastructure we operate. That path is opt-in, it is described in full below, and the local-only path is not going away when it ships.

On your machine, and nowhere else. toryo drives your coding agent against the repository already sitting on your disk. There is no cloud sandbox, no build container of ours, and no upload step. An agent working on your repository is a process on your laptop.

The knowledge your agents accumulate, the memory, the library, and the code index, is Postgres running locally: either in Docker or as an embedded pglite runtime. That database is yours.

Straight from your machine to the provider, under your own credentials. We do not supply model access, mark it up, or sit in the path, so nothing about your prompts or your agents’ output passes through us.

One thing to be precise about, because a security page is the wrong place for a rounded claim. Two small jobs inside toryo use a model rather than an agent: embedding text for search, and judging whether a memory is worth keeping. By default both run locally against Ollama on your own machine. We also operate a hosted service for teams that want everyone embedding against one byte-identical model, and it is opt-in and off unless you configure it. Your source code and your agent transcripts are not what it sees, and it is never on by default.

Not your code, not your prompts, not your agent output, not your knowledge plane. This is not a policy we maintain so much as a consequence of the architecture: we hold no copy of any of it to train on.

Licensing records: your email address, the seat and plan it belongs to, and an identifier for each machine you activate on with its first and last check-in. The privacy notice lists this in full.

Machine identifiers exist so one seat covers all of your machines rather than being consumed by the first. They are not device fingerprints.

We also hold a crash report each time toryo itself fails, unless you have turned that off. It carries toryo’s own stack, a scrubbed message, and which command failed; the privacy notice lists the whole of it.

The license service never sees Claude credentials. There is no field for them and no code path that would accept one: your subscription and your keys exist only on your own machine.

Every mutating admin action on that store appends an audit row, and the data sits on a provider that encrypts at rest with continuous point-in-time backup.

A team can point their installs at one knowledge plane instead of each keeping their own, so that what one person’s agents learn is available to everyone’s. It is opt-in, it is off until you configure it, and choosing it is the one decision that moves anything of yours onto infrastructure we run. Teams who would rather not make that trade keep the local plane, which is not a deprecated path and will not become one.

Your source code is still not in it. What the plane holds is what your agents learned and what your people authored: recorded memories, library documents, and the code index, which is file paths, exported symbol names, and the import graph between them rather than the contents of your files. Documents your team authors hold whatever you put in them, so treat the library the way you would treat any shared wiki.

Tenants are isolated at the database rather than in application code. Row-level security is forced on the knowledge tables and every query runs bound to your tenant, so a bug in our code cannot return another team’s rows. The store encrypts at rest and is backed up continuously with point-in-time restore.

Removing a tenant is deliberately two steps that cannot be confused for each other. Cutting access is reversible and touches no data. Destroying the data is separate, irreversible, and gated behind an explicit confirmation, so “revoke this now” can never quietly become “delete this forever”.

Activation checks in once and receives an Ed25519-signed proof your install caches. Everything after that is evaluated from the cache, so your day-to-day work never depends on our service being reachable, and a failed check-in on a paid license never blocks you.

The practical consequence is that toryo keeps working on a plane, behind a corporate proxy, or if we have an outage.

macOS builds are signed and notarized, so they open without a Gatekeeper warning. Every release publishes a SHA256SUMS file, and the downloads page shows each artifact’s hash so you can verify it before installing.

A great deal, by design: it writes code, runs commands, and opens pull requests. That is the product. It is worth being clear-eyed that this is a tool with real reach into your development environment.

The controls are yours. Sequences stop at approval gates you answer, work happens in isolated git worktrees rather than your working tree, and changes arrive as pull requests you review before merging. When a run needs a decision it messages you and waits, rather than guessing and carrying on.

It also reaches outward when a task needs it. A worker can be given a headless browser so it can read pages a plain fetch cannot, and the research sequence turns that on by default. That browser is a self-contained instance toryo spawns for the run, separate from the one you use.

The general rule is worth stating plainly, because it is the answer to most questions of this shape: toryo can do what your agent is configured to do, and nothing more. It drives the agent you already installed, with the credentials, permissions, MCP servers and tool access you already granted it. It does not widen that surface, and it has no privileged path of its own. If you would not want an agent session doing something, do not configure your agent to be able to, and toryo will not be able to either.

No SOC 2, no ISO 27001, and no HIPAA attestation. We are early, and we would rather say so than imply a compliance posture we have not earned.

If your procurement process needs one of those, tell us what and by when, and we will give you a straight answer about whether we can get there rather than a reassuring one.

Email support@toryo.ai with anything you find. We would rather hear about it early and awkwardly than late.