Verify it yourself: watch Vaulith on the wire

We keep saying your files never leave your device. Words are cheap — so here’s the reproducible way to test that claim on your own machine, with tools we don’t control. It takes about fifteen minutes, and you don’t need to be a network engineer.

Last updated: July 2026 · There are deliberately no screenshots on this page — a screenshot is just another claim. This is a method you run, not a capture you take our word for.

The claim you’re testing

Vaulith is not fully offline, and we’ve never claimed it is — how your privacy works lists every connection it makes. What we do claim, and what you can test here:

• Signed out, during scanning and AI analysis, Vaulith talks only to Ollama on your own machine (loopback, 127.0.0.1:11434 — traffic that never reaches the network) — plus one launch-time version check with GitHub Releases.
• Signed in, two things are added: a license check and a scan summary — counts, sizes, and timestamps only.
• Never, in any state: your files, photos, file names, paths, thumbnails, or contents.

Method 1 — Little Snitch (macOS, the clearest view)

Little Snitch is a per-app firewall that shows every outbound connection an app attempts, live. (Its free demo mode works for this test, as does LuLu, a free alternative from Objective-See.)

1. Install Little Snitch and open its Network Monitor (menu-bar icon → Show Network Monitor).
2. Launch Vaulith and find it in the Network Monitor’s app list.
3. Run a full scan — point it at your biggest folders, and let the AI analysis pass run too.
4. Watch Vaulith’s connection list while it works.

What you should see: a version check to GitHub at launch, and — only if you’re signed in — connections to Vaulith’s backend for the license check and scan summary. During the actual scanning and AI analysis: nothing new. The AI exchange happens over loopback to Ollama on your own machine, which never crosses the network interface at all.

Method 2 — Wireshark (macOS & Windows, the deep view)

Wireshark captures the raw traffic. Vaulith’s connections are TLS-encrypted (as they should be), so you can’t read the payloads — but that’s fine, because the two things that would expose a lying cleaner are visible anyway: who it talks to and how much it sends.

1. Install Wireshark and start a capture on your active interface (Wi-Fi or Ethernet).
2. Apply this display filter to see every DNS lookup and every TLS connection request, including the hostname each one is for:

3. Run a full Vaulith scan, including AI analysis, and let it finish.
4. Check the hostname list against the table below — it should be that short.
5. Then check the volume: Statistics → Conversations, sort by bytes sent from your machine.

The arithmetic is the proof. A scan that reads hundreds of gigabytes off your disk should produce outbound network traffic measured in kilobytes. You cannot hide gigabytes of uploads inside kilobytes of traffic — encryption hides content, it can’t hide size. If Vaulith were exfiltrating your files, this one sort-by-bytes view would catch it every time.

One quirk worth knowing: the local AI traffic won’t appear in this capture at all, because loopback traffic never reaches your Wi-Fi or Ethernet interface. To watch Vaulith talk to Ollama, start a second capture on the Loopback interface with the filter tcp.port == 11434 — that’s your files being analyzed, on your own machine, going nowhere.

Method 3 — Activity Monitor (macOS, zero install)

No tools, coarse but honest:

1. Open Activity Monitor (Applications → Utilities) and switch to the Network tab.
2. Find Vaulith in the process list and note its Sent Bytes.
3. Run a full scan and watch the number as gigabytes of disk are read.

Sent bytes should stay roughly flat — kilobytes, not gigabytes — no matter how much disk the scan covers. On Windows, Resource Monitor (run perfmon /res, Network tab) shows the same per-process send totals.

What you should see — the complete list

Hostnames reflect our infrastructure as of July 2026 and may change as we grow; the shape of the traffic — and what’s never in it — is the promise.

What you should never see

• Outbound volume that scales with your disk. Scanning 50 GB or 500 GB should make no difference to sent bytes.
• Advertising or analytics domains. There are no ad networks or usage-analytics trackers in the app.
• Uploads during the scan itself. Signed out, the scan and AI phases produce no new outbound connections at all (the sole exception: an anonymous crash report if the app itself errors — see the table above).