How-to guides
Enterprise security
Control outbound access, export independently verifiable activity records, and manage OOMU across an organization.
Two controls in Settings → Security exist for organizations that have to prove things, not just believe them: Air-Gap Mode, which stops all outbound network traffic, and the Audit Ledger, which exports a tamper-evident record signed by the Secure Enclave. Both are in the standard application.
When one Mac at a time is not enough, the same application can be managed by your organization: with a policy file, or by enrolling it in OOMU Control.
Air-Gap Mode
"OOMU pauses its internet connections. Cloud models, web search, and remote connections are unavailable. Local processing stays on this Mac."
One switch. When it is on, the panel shows Active; when off, Ready. Four protections are listed, and all four are enforced in native code:
| Protection | |
|---|---|
| Cloud AI blocked | No provider call, regardless of chat or agent settings. |
| Web search blocked | No public web search, by either route. |
| Remote connections blocked | No connector, no channel, no Browser Bridge, no marketplace. |
| Local routing enforced | Every turn resolves on this Mac. |
How it is enforced
Air-Gap Mode is not a flag the networking code is asked to check politely. Every outbound operation in OOMU must first acquire an egress permit from a process-wide guard. When the mode is on, the permit is refused and the operation fails with air_gap_mode_active.
Two properties are worth knowing:
- It fails closed at startup. The guard initializes to blocked before the setting is read from the encrypted database. If OOMU cannot determine your setting, nothing goes out.
- Turning it on drains in-flight work. Activating does not return until operations that already hold a socket permit have finished. There is no window where the switch reads Active while a request is still on the wire.
OOMU's own update checks, for the app, for the list of cloud models, and for the System 1 router, stop too. So do the Beta 4 features that use the network: Slack and Discord connections close, Mochi's weather and Topic Radar checks are refused, and Gmail and Google Calendar drop out of Mochi's choices, with a visible note that it has gone back to the Apple apps. When Air-Gap Mode is turned off, the Slack or Discord channels that were on reconnect by themselves.
What still works
Everything local, which in OOMU is most of it: chat on the on-device assistant, project files, Ask Documents, document comparison, document generation, Apple app automation, application control, the Quick Launcher, quick actions, Mochi and the interests that only read your Mac (Downloads, Apple Mail, Apple Calendar, Reminders), Ready for review, and standing memory.
The cloud model chooser explains itself rather than failing silently: "Cloud providers are unavailable in Air-Gap Mode. Turn off Air-Gap Mode in Security to use external AI providers."
The Audit Ledger
"Export tamper-evident activity records for governance and SIEM review."
Choose a date range and Export to Downloads. The file is JSONL, in the oomu.audit.export.v1 format, written privately to your Downloads folder, and the panel confirms {count} verified records.
What a record contains
One record per turn:
| Field | |
|---|---|
| Turn and session identifiers, and timestamps | |
| Reasoning route, provider, and model | |
| Tools invoked | |
| Files touched | |
| Verification status and receipt count | |
| Evidence digest | |
| Failure category, where one applies | |
| Previous entry digest | |
| Entry digest |
On a managed Mac, actions the organization's policy refused are recorded in the same append-only chain.
That last pair of fields is the point. Each entry's digest covers the previous entry's digest, so the records form a hash chain. Removing, reordering, or editing an entry breaks the chain, and the break is detectable by anyone with the file: no access to the original Mac required.
The signature
The export ends with a signature record over a cryptographic manifest covering the format, record count, date range, digest of all records, and the chain head.
| Property | |
|---|---|
| Signer | The Mac's Secure Enclave |
| Algorithm | ECDSA over SHA-256 |
| Key | Non-extractable, held by the Secure Enclave |
| Key ID | secure-enclave: plus a prefix of the public key's SHA-256 |
The Settings panel labels this Hardware-backed signature.
OOMU verifies its own signature before it will accept the export. If verification fails, or if the signature is not hardware-backed, the export is refused outright rather than produced with a caveat. The public key is included in the file so a third party can verify it independently.
Export safety
The output path must be absolute, must carry the .jsonl extension, and must not already exist, including as a symlink. An audit export cannot be tricked into overwriting a file or following a link somewhere else.
If the Secure Enclave is unavailable on the machine, the export fails with a specific reason. It does not silently downgrade to a software key.
Data residency and retention
Settings → Storage & Privacy covers the rest:
- "Chats, projects, documents, and settings are kept on this Mac."
- "Deleted chats, projects, and workflows are removed permanently after the Undo period ends."
The database is SQLCipher-encrypted, keyed from the macOS Keychain, with cipher_memory_security and secure_delete on. Credentials never live in the database: they live in the Keychain under a Beta 4-specific service namespace, and the database holds only opaque references.
Settings → GDPR & EU AI Act is the surface to send to a reviewer who needs specifics rather than assurances. It states what the encryption does not cover (exports, generated files, and caches can remain unencrypted on disk), what each deletion actually removes, and what the AI provenance metadata in generated DOCX and XLSX files is and is not. Its own framing is that these are statements of product behavior, not a certification, which is the correct thing for a vendor to say and the correct thing for a reviewer to hear. See Privacy & security for the full treatment.
Managed by your organization
A Mac nobody manages behaves exactly as described above: the person at it decides, macOS enforces, and nothing is reported anywhere. It starts no fleet connection and never looks for fleet credentials.
An organization can manage OOMU in two ways.
A policy file
An administrator places a policy.json in /Library/Application Support/OOMU/, usually through device management. OOMU reads it at startup and whenever it changes. It can set:
| Setting | Effect |
|---|---|
organization | The name Settings shows: Managed by {organization}. |
enforce_air_gap | Holds Air-Gap Mode on. The person at the Mac cannot turn it off. |
allow_cloud, allowed_providers | Whether cloud models may be used at all, and which providers. |
allowed_path_prefixes, denied_path_prefixes | Folders OOMU's file actions may, or may not, touch. |
allowed_mods, allow_untrusted_mods | Which Mods may be installed, and whether unsigned ones are allowed. |
allowed_local_models | Which local model files may be used. |
proxy_url, proxy_bypass, custom_root_ca_pem | A corporate proxy, and a root certificate for OOMU's own connections. |
A setting the policy controls is locked in the app, marked "This setting is managed by your organization." An action the policy forbids is refused with "Your organization doesn't allow this action," and recorded in the audit chain. An unreadable or malformed policy fails closed rather than being ignored.
Beta 4 follows the same policy. Mochi's answers and its background reading run on the same engine as everything else, so the policy's model and cloud rules apply to them: a Mac limited to approved local models or approved providers is limited in Mochi too. Forced Air-Gap Mode, from a policy file or from OOMU Control's emergency air-gap, closes Slack and Discord and stops the Mochi interests that use the network: weather, Topic Radar, Gmail, and Google Calendar. Files from scheduled runs wait for a person's approval on every Mac, managed or not.
Two limits in this build. There is no separate switch for Mochi, or for Slack and Discord, so an organization cannot turn one of them off while leaving the Mac online. And the Slack, Discord, weather, and Topic Radar connections do not yet go through the policy's proxy or trust its root certificate, and saving a file from Ready for review does not yet check the policy's folder rules.
OOMU Control
OOMU Control is the organization's own server for governing many Macs at once. It is a separate, licensed product, and it changes nothing about what the free application does for the person using it. OOMU 0.3 and later can be enrolled.
Enrollment. Control generates a configuration profile and an install script for your device management, such as Jamf Pro, Kandji, or Intune. The profile tells OOMU the server's address and the fingerprint of its signing key; OOMU verifies everything the server sends against that key, and a key the server merely advertises is not trusted. Settings then shows Fleet management configured.
Policy. Control sends the same kinds of rule as the policy file: local models only or approved providers, a proxy, and a root certificate. Every policy is signed, and OOMU refuses one that is unsigned, badly signed, or older than the one it already has. The Mac checks in every five minutes by default, and fetches a new policy when there is one.
Emergency air-gap. If the organization triggers it, the Mac drops every outside connection at its next check-in, cancels requests already in flight, and keeps working on local models.
What the Mac reports. At each check-in: how many turns ran locally and in the cloud, how many actions policy refused, and how long the system has been up. Security events, such as a blocked provider, are signed by the Mac and sent as metadata. Prompts, replies, documents, memories, file names, and credentials are never sent, and Control itself refuses any event that contains them.
What it cannot prove. Enrollment through device management creates a software key for the Mac. Control can verify that events came from whoever holds that key, but not that the key lives in the Secure Enclave, and it says so.
If you are evaluating OOMU for a fleet, this page is the per-machine half of the answer, and the OOMU Control page is the other half.
Telemetry, which does not exist
OOMU sends no diagnostics, usage metrics, or prompt history, to us or to anyone. There is no setting an administrator has to remember and no default to negotiate away. The app's own words: "OOMU does not send diagnostics, prompt history, or usage metrics as telemetry. Update checks send the app version and processor architecture, without a device or account identifier."
For evaluation purposes: the outbound surface of an untouched installation is its update checks, and nothing else. A managed Mac adds its check-ins to your own Control server.
Related
- Privacy & security: the full model.
- Local database schema: what is stored and how.
- Evidence & receipts: what the audit records are records of.