Switchboard trust information
Code and document review date: 2026-11-03. Business features in this branch are not a production-service certification. Ask [to be confirmed: contact email] for the current release and deployment status.
Switchboard runs Mac automation locally. I make it as a one-person business, Kyle Carson doing business as Switchboard. I have no SOC 2 or ISO 27001 certificate, independent penetration-test report, cyber-insurance certificate, dedicated security team or uptime SLA.
What leaves the Mac
| Path | When and recipient | Data | Control or limit |
| Account and licence | Trial, email/company sign-in and daily online licence refresh; Switchboard account server | Email when supplied, device name, salted hardware hash, version, licence and device credentials | An offline team LicenceFile avoids account sign-in and refresh. A first anonymous trial still contacts the server. |
| Payment and invoices | Checkout or an invoice request; Paddle, and Switchboard for invoice creation | Email, company, billing address, seat count and optional PO number; payment details go to Paddle | Purchasing is explicit. Paddle's applicable checkout and privacy terms govern payment processing. |
| Company identity | Company sign-in; configured OIDC issuer and Switchboard server | Email/domain, authorization code, verified identity claims | Owner emailed-code access always remains. IdP tokens stay on the server and are not persisted. |
| Switchboard AI relay | A relay model request; Switchboard then Anthropic | Prompt, selected context and attachments; usage counts and cost | AIAllowed=false or RelayAllowed=false; AI is optional and Team has no included allowance. |
| Your own model key | A BYOK request; your selected provider | API key, prompt and selected attachments | AIAllowed=false; provider privacy terms apply. |
| iCloud library sync | Sync enabled; Apple private CloudKit database | Library records | iCloudSyncAllowed=false; the app setting defaults on when iCloud is available. |
| Phone and Watch | Paired approvals and remote actions; Apple services and configured approval transport | Pairing/action/approval data | Do not pair or enable remote services. MCPAllowed does not disable phone approvals. |
| HTTP macros and scripts | When a macro requests network access; the URL or program you chose | Whatever the macro sends | Review permissions and macros. ShellStepsAllowed=false blocks shell, AppleScript and CLI steps; it does not block ordinary HTTP steps. |
| Extensions | Installed extensions and their permitted network operations | Data allowed by extension permissions | ExtensionAllowlist restricts installation. Review existing extensions before deployment; do not assume installation filtering is a network firewall. |
| Shared/exported macros | Explicit share or file export; chosen recipient | Macro content, which can include literals | Review before sharing. SharingAllowed disables the share menu; full export enforcement remains a release gate. |
| Updates | Public updater check; Switchboard release host | Update request metadata | UpdateChannel=none disables Sparkle. stable and beta select their respective feeds. |
| Feedback | You choose to send feedback; Switchboard support | Text and diagnostic context selected by the feedback flow | Review the submission. App feedback is distinct from website visit measurement. |
There is no automatic upload of the local macro library or trace database to the account server. Recipients also receive ordinary connection metadata, including IP addresses. Web requests and user-written macros can still send private data. Disable AI if your policy prohibits sending prompts off the Mac.
Account storage and retention
The SQLite account database stores accounts, hashed device/web/SCIM credentials, licences, team membership, device seats, invoice references and team events. OIDC client secrets are encrypted using a key derived from the installation's authentication pepper. Sign-in states expire after 10 minutes; app SSO grants are single-use and expire after 60 seconds. App grants require a private verifier held by the Mac that started sign-in.
Local successful traces default to 30 days, failed traces to at least 90 days, with count and size limits. Traces may contain text typed by a macro, model inputs/outputs and other sensitive values. Server rate-limit events can contain an IP address or email in their key; events older than 24 hours are removed opportunistically during new requests, not on a guaranteed deletion deadline. The server does not currently automatically purge team-event/account history. A deletion request requires operator handling; do not infer deletion from deactivating a person in SCIM.
Production hosting region, disk encryption, nightly backups and a tested restore are not verified by this document. These are launch gates, not controls I claim are running.
Controls and their limits
Signed licences use Ed25519 and are verified locally. Device, browser and SCIM bearer secrets are stored as hashes on the server. The public service must be behind HTTPS; a local development server is not a safe public deployment. OIDC uses state, nonce, PKCE and signature/issuer/audience/time checks. SCIM cannot remove the owner.
App and engine run as separate processes. That separation is useful for reliability; it is not proof that all automation is sandboxed. A customer intentionally grants Accessibility and other macOS permissions so macros can operate other apps.
Release scripts sign and notarize release artifacts when the operator supplies the required certificates. The build and test gates are controls in the repository, not a substitute for an independent penetration test.
Audit exports
Activity has "Export audit log..." and the CLI has switchboard trace export --since 2026-11-01T00:00:00Z --format jsonl. They export retained runs in chronological order, including steps, outcomes, agent metadata and any approval notes recorded in the trace. Retained broker decisions are separate approval records; the broker keeps up to 200 and does not reliably associate each decision with a run. New run records capture the cached account email and Mac name at first write; older records have unknown identity. Offline licence-file runs do not identify an individual.
An owner/admin can download server events from Account > Team or GET /v1/team/events. Operator CLI: python3 server/serve.py team events owner@example.com --since 2026-11-01.
Abbreviated local sample: {"version":1,"type":"run","identity":{"email":"person@example.com","mac":"Work Mac"},"run":{"id":"run-1","macroId":"macro-1","status":"succeeded"}}.
Abbreviated server sample: {"ts":1793491200,"actor":"owner@example.com","kind":"member.added","subject":"person@example.com"}.
These logs are local/server records, not tamper-proof evidence. Review exports before sending them to a third party. Local exports include trace inputs and outputs.
Continuity
A Standard or Founder licence does not need a running account server to verify a previously issued valid licence. Standard still respects its update cutoff. Subscriptions and offline team files expire at their signed end dates, even if the company stops operating. I do not promise that team subscriptions will run forever without renewal.
See the forty-question questionnaire, disclosure policy, terms and DPA draft.