Inspect network requests with the Egress log

Trust in a privacy-focused notes app should be verifiable through empirical evidence, not blind faith or marketing promises. Oyma includes a built-in, real-time Egress log that records every network socket connection and HTTP request initiated by the application.

Whether you work in a regulated legal practice, handle privileged medical records, manage enterprise financial audits, or simply demand that your meeting recordings remain private, the Egress log allows you to independently verify and audit all network activity on your Mac.

Why client-side network auditing matters

Traditional cloud productivity apps hide their network activity behind minified JavaScript bundles and background syncing daemons. A typical cloud notes tool contacts dozens of third-party domains every hour for telemetry, crash trackers, ad retargeting pixels, and database replication.

Oyma takes an inverted, transparent approach:

Dimension / Behavior	Typical Cloud Note App	Oyma Native Architecture
Outbound Analytics	10–25 third-party tracking SDKs	Zero tracking SDKs or behavioral analytics
Meeting Audio Routing	Uploaded to remote transcription servers	Processed 100% locally on Apple Silicon
Telemetry Payloads	Background heartbeat every 30–60 seconds	Completely silent; zero background pings
In-app Network Audit	Hidden; blocked from inspection	Full real-time ledger visible to the user
Audit Log Export	Not supported	One-click JSON or CSV cryptographic export
Offline Hard Enforcement	App breaks or degrades without cloud	Full offline operation with physical socket killswitch

How the Egress log captures network events

The Egress log operates at the lowest networking abstraction layer of the application runtime:

1. Main process interception: Electron’s session.defaultSession.webRequest subsystem intercepts all renderer HTTP and WebSocket requests before they reach the OS networking stack.
2. Node runtime socket hooks: Low-level http.request and https.request modules are wrapped with non-blocking diagnostic probes.
3. Loopback detection: Network destinations resolving to 127.0.0.1, ::1, or localhost are flagged as Local (Loopback) so you can easily distinguish local AI queries from true internet requests.

How to open and use the Egress log

You can open the network ledger at any time:

1. Press ⌘O to open the Command Palette.
2. Type >Open Egress log and press Enter. Alternatively, go to Settings (⌘,) → Privacy → View Egress Log.
3. A floating diagnostic window appears showing real-time network traffic.

Ledger schema and column definitions

The Egress log provides rich diagnostic metadata for each connection:

• Timestamp: Precise millisecond timestamp (YYYY-MM-DD HH:mm:ss.SSS).
• Origin Process: Identifies whether the call originated from the Main Process (e.g., auto-update checks) or the Renderer Process (e.g., BYOK API calls).
• Destination: Target hostname and port (e.g., api.anthropic.com:443 or 127.0.0.1:11434).
• Method & Path: HTTP verb and endpoint path (e.g., POST /v1/messages).
• Bytes Sent / Received: Exact byte-level tally of transmitted and received data packets.
• TLS Version: Encryption cipher suite and protocol (e.g., TLS 1.3).
• Status & Policy: Displays HTTP status code (200 OK, 401 Unauthorized) or enforcement outcome (ALLOWED vs BLOCKED_BY_LOCAL_MODE).

What normal activity looks like in Oyma

When using Oyma throughout a standard workday, here is what you will observe in the Egress log:

1. Taking notes and searching

• Ledger state: Completely blank. Zero entries are generated.
• Explanation: Note creation, Markdown parsing, graph rendering, and SQLite FTS5 search run entirely inside local memory and disk storage.

2. Live meeting recording and transcription

• Ledger state: Completely blank. Zero entries are generated.
• Explanation: Audio capture uses native macOS CoreAudio APIs. Transcription runs on your Mac’s Apple Silicon Neural Engine using embedded Whisper models. Zero audio bytes touch your network card.

3. Local AI summaries with Ollama

• Ledger state: Entries show 127.0.0.1:11434 with status LOCAL_LOOPBACK.
• Explanation: Communication with Ollama occurs over local loopback interfaces. No data traverses external routers or the public internet.

4. Cloud AI summaries using your own API keys

• Ledger state: Single HTTPS POST to api.anthropic.com or api.openai.com.
• Explanation: Shows the exact byte payload of the meeting transcript sent and the summary received.

5. Application update checks

• Ledger state: Occasional lightweight GET to updates.getoyma.com (disabled if Local-only mode is active).

Exporting audit reports for security compliance

For enterprise teams, HIPAA compliance officers, or security evaluations, Oyma allows you to export verified network records:

1. In the Egress log window, click Export Audit Ledger….
2. Choose your format:
   • JSON Ledger: Machine-readable JSON array with timestamps, destinations, byte counters, and cryptographic checksums.
   • CSV Ledger: Tabular data ready for Excel or enterprise SIEM log ingestion.
3. Select a destination folder in your vault.

The export automatically sanitizes any sensitive Authorization headers while preserving byte volumes and endpoint verification.

Enforcing a physical network killswitch

If your threat model requires absolute certainty that zero outbound packets can leave the application under any circumstances, combine the Egress log with Local-only mode. Local-only mode physically severs all non-loopback networking sockets at the runtime level. Any outbound network call is immediately rejected and recorded in the Egress log as BLOCKED_BY_POLICY.

To learn more about how Oyma isolates notes and media locally, read our comprehensive privacy architecture and guide to on-device AI with Ollama.