diff --git a/pym/update/profile.py b/pym/update/profile.py
index 7a5c05e..11017eb 100644
--- a/pym/update/profile.py
+++ b/pym/update/profile.py
@@ -15,6 +15,7 @@
 #  limitations under the License.
 
 import sys
+import os
 from os import path
 import shutil
 from calculate.lib.utils.files import (listDirectory, readFile, readLinesFile,
@@ -205,6 +206,12 @@ class ProfileRepository(object):
         rpath = path.join(storage.directory, name)
         if path.exists(rpath):
             removeDir(rpath)
+        if git.is_private_url(url):
+            try:
+                makeDirectory(rpath)
+                os.chmod(rpath, 0700)
+            except OSError:
+                pass
         git.cloneRepository(url, rpath, branch)
         pr = cls(git, name, storage)
         repo_name = pr.repo_name
diff --git a/pym/update/update.py b/pym/update/update.py
index 55db480..e5f8643 100644
--- a/pym/update/update.py
+++ b/pym/update/update.py
@@ -37,6 +37,7 @@ from calculate.lib.cl_log import log
 import re
 import shutil
 from collections import MutableSet
+from contextlib import contextmanager
 
 from calculate.lib.utils.git import Git, GitError, MTimeKeeper, NotGitError
 from calculate.lib.utils.portage import (Layman, EmergeLog,
@@ -51,7 +52,8 @@ Colors = TextState.Colors
 from calculate.lib.utils.files import (getProgPath, STDOUT, removeDir,
                                        PercentProgress, process, getRunCommands,
                                        readFile, listDirectory, pathJoin,
-                                       writeFile)
+                                       find, FindFileType,
+                                       writeFile, makeDirectory)
 import emerge_parser
 import logging
 from emerge_parser import (EmergeParser, EmergeCommand, EmergeError,
@@ -156,6 +158,30 @@ class Update(MethodsInterface):
     def getGit(self):
         return self.clVars.Get('cl_update_git')
 
+    @contextmanager
+    def private_repo(self, rpath, url):
+        if Git.is_private_url(url):
+            try:
+                if not path.exists(rpath):
+                    makeDirectory(rpath)
+                os.chmod(rpath, 0700)
+                yield
+            finally:
+                try:
+                    for dn in (Git._gitDir(rpath), path.join(rpath, "profiles/templates")):
+                        if path.exists(dn):
+                            os.chmod(dn, 0700)
+                    for fn in find(path.join(rpath, "profiles"), True, FindFileType.RegularFile,
+                                   True, None, downfilter=lambda x: not x.endswith("/templates")):
+                        if fn.endswith("calculate.env") or fn.endswith("ini.env"):
+                            os.chmod(fn, 0600)
+                    if path.exists(rpath):
+                        os.chmod(rpath, 0755)
+                except OSError:
+                    pass
+        else:
+            yield
+
     def _syncRepository(self, name, url, rpath, revision,
                         cb_progress=None, clean=False, notask=False):
         """
@@ -174,8 +200,9 @@ class Update(MethodsInterface):
                     self.startTask(_("Syncing the {rep} repository").format(
                         rep=name.capitalize()))
                 self.addProgress()
-                git.cloneTagRepository(url, rpath, revision,
-                                       cb_progress=cb_progress)
+                with self.private_repo(rpath, url):
+                    git.cloneTagRepository(url, rpath, revision,
+                                           cb_progress=cb_progress)
                 info_outdated = True
             else:
                 cr = ""
@@ -197,9 +224,10 @@ class Update(MethodsInterface):
                         self.startTask(_("Syncing the {rep} repository").format(
                             rep=name.capitalize()))
                     self.addProgress()
-                    git.updateTagRepository(url, rpath, revision,
-                                            cb_progress=cb_progress,
-                                            clean=clean)
+                    with self.private_repo(rpath, url):
+                        git.updateTagRepository(url, rpath, revision,
+                                                cb_progress=cb_progress,
+                                                clean=clean)
                     new_cr = git.getCurrentCommit(rpath)
                     if new_cr != cr:
                         info_outdated = True
@@ -385,12 +413,6 @@ class Update(MethodsInterface):
             if repname not in ("portage", "gentoo"):
                 layman.add(repname, url, rpath_orig)
         finally:
-            try:
-                if (path.exists(rpath) and
-                            Git.parse_url(url)[0] == Git.GitProtocol.SSH):
-                    os.chmod(rpath, 0700)
-            except OSError:
-                pass
             mtime.restore()
         return True