DISCLAIMER: This page is for information only. It is not legal, financial or procurement advice and does not replace your own due diligence. Licenses, ownership, features and certifications can change: confirm what your decision rests on with the official sources.
🩺 Vitals
- 🟢 Last active: 2026-11-03
- 📦 Latest release: v1.22.0 (2026-11-02)
- 🐞 Open issues: 357
- 🌟 Stars: 22.2k
What do these metrics mean?
- Last active: when code was last pushed, as of our last check. The dot is green when that was recent, grey otherwise. A long gap can mean a tool is finished and stable, not only unmaintained.
- Latest release: the most recent stable version the maintainers published as a release on the forge. Some healthy projects publish only tags, or publish their versions elsewhere.
- Open issues: unresolved reports and requests. A high number is normal for a popular project and is not a warning on its own.
- Stars: how many people bookmarked the project on its forge. A rough popularity signal, not a measure of quality.
🏗️ Profile
- Official: dyad.sh
- Source: github.com/dyad-sh/dyad
- License: Apache 2.0 (Core) | FSL 1.1 (Pro)
- Deployment: Desktop App | Docker
- Data Model: Local SQLite / Local Files
- Jurisdiction: United States 🇺🇸 (Dyad Tech, Inc.) | United Kingdom 🇬🇧 (Dyad AI Ltd.)
- Compliance (SaaS): GDPR | UK GDPR
- Compliance (Self-Hosted): HIPAA Eligible | GDPR Ready | ISO 27001 Ready
- Complexity: Minimal (1/5) - Desktop Installer / Docker
- Maintenance: Minimal (1/5) - Local binary / container updates
- User Management: Minimal (1/5) - Single-user desktop app; no multi-user auth, SSO, RBAC or audit
1. The Executive Summary
What is it? Dyad is an autonomous AI coding agent and application builder designed as a secure, local-first alternative to cloud-hosted tools like Bolt.new or Replit. By operating primarily on the developer's local machine and supporting "Bring Your Own Key" (BYOK) model connectivity (e.g., Azure OpenAI), it ensures that proprietary source code and sensitive prompts remain within the organization's secure perimeter.
The Strategic Verdict:
- 🔴 For Hosted Pro/Max Credits: Caution. For teams using Dyad’s hosted AI credits rather than BYOK, data is proxied through their servers. While encrypted and non-training, it represents a cloud transit point for organizations with strict "No-Cloud" mandates.
- 🟢 For Engineering Governance: Strong Buy (BYOK Mode). By enforcing corporate API keys within Dyad's local-first architecture, organizations can empower developers with autonomous AI building capabilities while maintaining 100% data sovereignty and preventing IP leaks.
2. The "Hidden" Costs (TCO Analysis)
| Cost Component | Bolt.new (SaaS) | Dyad (Self-Hosted) |
|---|---|---|
| User Seat Fee | ~$20+/user/mo | $0 (Apache 2.0 Core) |
| Model API Cost | Bundled (Opaque) | Direct (Pay-per-token) |
| Data Residency | Vendor-Dependent | Local (Zero Exposure) |
| IP Protection | Shared Responsibility | Full Local Ownership |
3. The "Day 2" Reality Check
🚀 Deployment & Operations
- Installation: Available as a standard desktop application (macOS/Windows/Linux) or via Docker for centralized team environments. Its local-first design ensures high responsiveness and offline capability.
- Interoperability: Output is standard React/TypeScript code. Projects are stored in standard local directories, ensuring they can be opened in any IDE (Cursor, VS Code) or deployed to any provider (Vercel, Netlify) without vendor lock-in.
🛡️ Security & Governance (Risk Assessment)
- Jurisdiction & Geopolitics: Dyad Tech, Inc. is a US-based entity (Boston), with a UK subsidiary (London) registered with the ICO (ZB613404). This dual-jurisdiction footprint provides a familiar legal framework for Western enterprises. Self-hosting via BYOK mode mitigates US cloud jurisdiction concerns (e.g., the CLOUD Act) as code never leaves the local disk.
- The Compliance Shift: Using the local-first application facilitates HIPAA and GDPR compliance by keeping data on-premise. However, the "Shared Responsibility" model shifts to the user: your IT team is responsible for securing the local device, managing API key rotation, and ensuring the underlying OS is patched.
- The License Risk (FSL-1.1): While the core is Apache 2.0, advanced "Pro" features (like Agent Mode and Smart Context) are licensed under FSL 1.1. This restricts "Competing Use" (you cannot sell a competing AI app builder based on Dyad's Pro code), but allows for full internal enterprise use and modification.
4. Market Landscape
🏢 Proprietary Incumbents
- Bolt.new: Leading "one-prompt" app builder but strictly cloud-hosted, creating high IP risk for enterprise codebases.
- Replit Agent: Highly integrated but locks the organization into the Replit cloud ecosystem and data policies.