How it runs
Your machine does the work
The extension executes locally and reviews only the change in front of you.
A local-first VS Code extension
Tyne is a Visual Studio Code extension. Its core work — reading your working tree, staging changes, running the deterministic review checks, and managing branches — happens on your own machine, inside the editor. There is no always-on agent watching your repository from the cloud.
You trigger the work
Reviews run against the change in front of you — the diff you are editing or about to commit — not your whole codebase, and not on a background schedule you cannot see. Nothing is analysed until you act.
Deterministic checks run before any model
The rule-based checks — hardcoded-secret scanning and data-flow heuristics — are deterministic and run locally. A language model is only involved for the reasoning steps, and only on the slice of code under review.
Data flow
What leaves your machine, and when
You choose the mode. In neither mode does your full repository leave your environment.
BYOK mode — your code does not touch our servers
When you bring your own key (Claude or OpenAI), model requests go directly from your machine to that provider under your own account and terms. Tyne’s servers do not receive your code in this mode.
Managed mode — only the diff boundary is sent
If you use Tyne’s managed review service, we send only the specific diff under review and the linked ticket text — never your full repository, never files outside the diff, and never your git history. The diff is analysed to produce the report and is not retained as a training corpus.
Privacy Enhanced mode redacts secrets
Tyne offers Cloud, Privacy Enhanced, and Local Compliance modes. In Privacy Enhanced mode, anything the local scan flags as a credential is redacted client-side before the diff leaves your machine — the review reasons about the shape of the code, not the secret itself.
Permissions
What Tyne can, and cannot, touch
Every connection is scoped to the job and revocable by you.
GitHub — code and pull requests only
Tyne signs in through GitHub’s device flow — no password is typed into the editor — and works with your code, branches, and draft pull requests. It does not touch your organisation’s billing, member management, or account settings.
Jira & Linear — the issues you connect
When you connect a project board over OAuth, Tyne reads the acceptance criteria on the tickets you work and writes verification status and evidence back to those same tickets. You authorise the connection in your browser and can revoke it at any time.
What we never do
No training, no keystroke logging
The short list of things we will not do with your code.
We do not train on your code
Your source code is not used to train models. In BYOK mode it never reaches us; in managed mode it is used to generate your review and is not added to any training set.
We do not record keystrokes
Tyne does not log what you type. It works from committed and staged changes, not a keystroke stream.
What we do collect is operational only
We collect operational telemetry to enforce plan limits and fix bugs: feature-usage counts, review-run counts, timestamps, and error diagnostics. The exhaustive list is documented in the Privacy Policy.
Honest disclosure
Our security posture, stated plainly
We would rather under-claim than mislead you during beta.
Tyne is in private beta. We have not yet completed a third-party security certification such as SOC 2 or ISO 27001. Our posture today is self-assessed, and an independent audit is planned before general availability. This page describes our current practices — it is not a warranty, and it does not replace the Privacy Policy or Terms.
Responsible disclosure
Found a vulnerability? We want to hear about it before anyone else does. Reach us through the security contact in our Privacy Policy and we will acknowledge your report and keep you updated on the fix.
Your data, on request
You can disconnect any integration from the Tyne sidebar, and request deletion of your account and associated data at any time. Retention windows are documented in the Privacy Policy.
Read the binding documents