How does the network egress monitor verify that zero data leaves your Mac?

Trust Through Verifiable Instrumentation

Software marketing pages frequently claim that “your privacy is our top priority,” while their underlying code silently transmits megabytes of behavioral telemetry, document metadata, and user identifiers to analytics brokers.

Oyma believes that security claims must be verifiable by the user.

Inside the Network Egress Monitor

Located in Preferences > Security > Network Egress Log, this feature provides an auditable, real-time window into the application’s network layer:

• Socket State Monitoring: Tracks every POSIX socket creation, TCP connection attempt, and TLS handshake.
• Full Payload Inspection: If you configure an optional remote BYOK provider (such as OpenAI or Anthropic), the log reveals the exact HTTP headers, payload bytes, and destination IP address sent.
• Zero-Byte Ledger: In default local mode (using local Whisper and Ollama), the total outbound byte counter remains strictly at 0 Bytes.

--- [Oyma Real-Time Egress Log] ---
[14:02:11] Socket Open Request: BLOCKED (Local Mode Active)
[14:02:11] DNS Lookup: None
[14:02:12] Transcription: Whisper Large v3 (Apple Neural Engine CoreML) -> 0 bytes sent
[14:02:15] Search Query: SQLite FTS5 Local NVMe -> 0 bytes sent
[14:02:18] Status: Network Inactive | Outbound Bytes: 0 B | Inbound Bytes: 0 B

Auditing with macOS Operating System Tools

You do not have to rely solely on Oyma‘s internal log. You can verify network silence using native macOS system tools:

# Verify with netstat while Oyma is running and transcribing
netstat -anv | grep -i Oyma

# Inspect active open files and sockets
lsof -c Oyma -i

Corporate security administrators can also inspect Oyma using network packet analyzers like Wireshark or firewall monitors like Little Snitch, confirming zero telemetry transmission.

Technical Auditing of Network Socket Connections

Verifying that software makes zero unauthorized network connections:

• Real-Time Socket Ledger: Intercepts and logs POSIX socket attempts, DNS lookups, and HTTP requests directly.
• Zero Outbound Bytes: Confirms that local editing, searching, and transcription produce zero network traffic.
• BYOK Payload Transparency: When using remote AI keys, inspect the exact prompt bytes and destination URLs sent.
• Operating System Verification: Cross-check application network silence using Little Snitch, Wireshark, or macOS netstat.

Auditable Network Silence and Peace of Mind

Inspect socket connections in real time via the Network Egress Monitor. Local mode confirms zero outbound bytes, providing verifiable proof that private documents never leave your physical hardware.

The egress monitor logs every socket connection, DNS resolution, and destination IP address, giving InfoSec teams the auditable proof they need to approve the software for sensitive enterprise environments.