Local-only mode

Most commercial desktop software treats an internet connection as a mandatory requirement. Applications continually phone home in the background to validate licenses, synchronize cloud databases, stream diagnostic telemetry, or load remote web assets.

Even when apps feature an “offline mode,” users have no verifiable assurance that background processes are not queuing sensitive data to upload the moment connectivity is restored.

For attorneys handling sealed litigation, defense contractors operating under strict compliance protocols, medical professionals reviewing patient records, and executives conducting confidential negotiations, “trust us” is not an acceptable security posture.

Oyma introduces an architectural kill-switch: Local-Only Mode. Proven in src/processing/network-guard.ts and validated by e2e/local-only-journey.spec.ts, this feature severs all external network capability at the application runtime boundary, guaranteeing that your Mac remains an impenetrable sovereign fortress.

The Network Guard: Enforcement at the runtime boundary

Local-Only Mode is not a cosmetic UI toggle; it is an active firewall built directly into the application process.

When you flip the switch to activate Local-Only Mode:

1. Socket interceptor activation: The network guard registers low-level hooks on Node.js and Chromium network layers, intercepting fetch, XMLHttpRequest, raw TCP sockets, and WebSocket constructors.
2. External destination rejection: Any attempted network transmission toward external IP addresses or domain names is terminated immediately with an explicit NetworkGuardBlockedError.
3. Loopback exemption for local models: Communications directed at loopback addresses (127.0.0.1 and localhost) remain permitted exclusively to enable communications with your local Ollama AI runtime.
4. Zero queued telemetry: The application disables crash reporting pipelines, ensuring no crash dumps or diagnostic packets are buffered in local caches for subsequent upload.

You do not need to take our word for it; you can verify the total absence of outbound traffic anytime using macOS packet tracing utilities like tcpdump or Wireshark, or by reviewing our published privacy architecture.

Uncompromised core functionality without the cloud

In cloud-dependent tools, severing network access turns the application into an unresponsive brick. In Oyma, the entire application was architected local-first from the initial commit.

When operating in Local-Only Mode, your day-to-day workflow proceeds with zero degradation:

• Record meetings without bots: Capture system audio and microphone streams via zero-bot meeting recording.
• Transcribe spoken dialogue: Stream live real-time speech-to-text using local live Whisper transcription.
• Author rich documents: Edit notes with fluid typography in the live-preview Markdown editor.
• Search your vault in milliseconds: Query thousands of documents instantaneously using embedded full-text search.
• Structure complex data: Manage data with spreadsheet-like tables and navigate networks using wikilinks & backlinks.

Every capability required to capture, organize, and synthesize knowledge executes locally on your Mac’s own processor and memory.

Air-gap readiness for high-stakes professional environments

For professionals operating in regulated or high-security sectors, Local-Only Mode satisfies rigorous compliance standards:

• Legal confidentiality: Protect attorney-client privilege during internal corporate investigations and patent depositions.
• Healthcare documentation: Safeguard patient consultations and psychiatric session records against third-party breach liabilities.
• Investigative journalism: Maintain total source confidentiality when analyzing leaked datasets or interviewing whistleblowers.
• Defense and critical infrastructure: Operate inside secure compartmented facilities (SCIFs) where external network egress is strictly forbidden.

When combined with our Obsidian vault compatibility, you can store your notes on encrypted local APFS volumes, ensuring physical and digital sovereignty over your life’s work.

Local backup protocols and encrypted vault storage

When your software operates strictly offline, data protection depends entirely on your personal storage hygiene rather than vendor cloud redundancy.

Oyma facilitates robust local backup workflows that align with sovereign computing:

• Direct Time Machine compatibility: Because notes are saved as plain Markdown files on local disk, native macOS Time Machine backups archive your notes incrementally without proprietary database locks.
• FileVault disk encryption: Running Oyma on FileVault-encrypted APFS drives guarantees that even if a laptop is physically lost or stolen, your meeting records and transcripts remain cryptographically sealed.
• Git version control compatibility: For technical writers and developers, your vault can be initialized as a local Git repository, giving you immutable commit history and branch management without uploading to remote servers.

Verifiable trust through automated regression suites

Security claims are meaningless without continuous automated verification.

Oyma validates Local-Only Mode on every build through dedicated end-to-end integration tests (e2e/local-only-journey.spec.ts). The test suite simulates full meeting recording sessions, file imports, and note authoring flows while actively monitoring virtual network adapters. The build script asserts that the byte count emitted across external network interfaces equals exactly zero.

If any newly introduced code or dependency attempts an unauthorized network call, the test suite fails immediately, preventing compromised builds from ever reaching users.

Take complete command of your digital perimeter with Local-Only Mode in Oyma.