Every claim hereis checkable.
With the open-source engine, the source is open, the parsing is local, and there is no server of ours in the loop. Each of those can be verified against the code.
What never leaves it.
Three things, and none of them has anywhere else to be.
- Your source code
- Parsed entirely on-device by 36 bundled tree-sitter grammars. No API is called to read or analyse it.
- The parsed graph
- Every node and edge is computed and stored locally. Querying it is a local read, not a network request.
- The artifacts
- graph.html, GRAPH_REPORT.md and graph.json, written into your own repository in formats you can open and inspect.
What your provider sees.
Stated plainly, because this is the part every other security page leaves vague.
- What your assistant sends
- The queries and prompts it chooses to send its model, under your keys, through your provider, on your terms. Graphify adds no channel of its own.
- Nothing from Graphify
- The open-source core has no server behind it. It makes no network calls of its own and sends no telemetry: there is nowhere for your data to go.
Four things you can go and look at.
None of them asks you to believe a page.
Open source, Apache 2.0
The full source is public and auditable. Every claim on this page can be checked against the code rather than taken on faith.
On-device parsing
In the open-source engine, the deterministic pass makes no network calls and your code is never uploaded.
No telemetry
There is no analytics SDK and no phone-home in the open-source codebase. The only network activity is what you start yourself.
A named team
Built by Graphify Labs, Y Combinator S26, and maintained by Safi Shamsi, the copyright holder named in the LICENSE file.
Official channels.
Other domains using the Graphify name, graphify.net among them, are not ours.
graphify.com
The only official Graphify website, operated by Graphify Labs.
Graphify-Labs/graphify
The Apache 2.0 source on GitHub. Releases are cut from this repository, and its README links back here.
graphifyy on PyPI
The only official distribution. Note the double y. Its metadata points at the GitHub organisation above.
Where each one actually is.
Two of these are in progress and say so. A trust page that rounds those up is worth less than none.
- SOC 2 Type II
- Engagement Started. Our SOC 2 Type II engagement for the enterprise offering has started. There is no report yet; updates will be published here as the engagement progresses.
- Encryption
- The hosted enterprise layer is being built to TLS 1.3 in transit and AES-256 at rest, part of the early-access track. The open-source core needs none of it: it never sends your data anywhere.
- SSO and audit logs
- SSO over OIDC and JWT; the MCP server speaks OAuth 2.1 with your IdP. SAML is available with Enterprise. Exportable audit logs are part of the early-access track.
- Self-host and VPC
- Run the open-source core air-gapped or in your own VPC. What you ingest never leaves your infrastructure.
- On-device by default
- The CLI builds and queries your graph locally. No account, no telemetry, no server in the loop.
- Data ownership
- Your data is yours. Export or delete it at any time. We never train on it and never sell it.
Questions about trust
What people ask before they install it.
Yes, and you can verify it instead of taking our word for it. Graphify is Apache 2.0-licensed open source at github.com/Graphify-Labs/graphify, so the code is fully auditable. Parsing runs on your device with bundled tree-sitter grammars, and the deterministic pass makes no network calls and sends no telemetry. The official package is graphifyy on PyPI.
With the open-source engine, no: your code is parsed on-device and never uploaded, it has no server of its own, and there is no telemetry. The only network activity is what you explicitly initiate: content you ask it to fetch with graphify add <url>, or the optional LLM backend you configure for semantic extraction, called with your own API keys. The hosted product at app.graphify.com is the other option, where Graphify builds and keeps your graph in the cloud on the repositories you connect.
Graphify is an open-source project by Graphify Labs, a Y Combinator S26 company, with a named maintainer, Safi Shamsi. The source is public at github.com/Graphify-Labs/graphify under the Apache 2.0 license, the official package is graphifyy on PyPI, and both point back to graphify.com.
The official website is graphify.com. The only official code sources are the GitHub organization github.com/Graphify-Labs/graphify and the PyPI package graphifyy. Other domains that use the Graphify name, for example graphify.net, are not affiliated with or operated by Graphify Labs.
Install the official PyPI package with uv tool install graphifyy (the package name has a double y), or build from source at github.com/Graphify-Labs/graphify. If you found instructions or downloads on another domain, verify them against graphify.com/docs/install before running anything.