Engine documentation

Verify it yourself: watch Vaulith on the wire

We keep saying your files never leave your device. Words are cheap. Here is how to test the claim on your own computer, with tools we don’t control. The quick version takes about a minute. The deep version stands up to Wireshark.

Last updated: August 12, 2026 · No screenshots here, on purpose — a screenshot is just another claim. This is a method you run yourself.

The claim you’re testing

Vaulith is not fully offline, and we have never claimed it is. Every connection it makes is listed on how your privacy works. Here is what we do claim, and what you can test:

Signed out, a scan opens no network connection of its own. If you already run Ollama, it talks to Ollama on your own machine (loopback, 127.0.0.1:11434, traffic that never reaches the network). The only other traffic is one version check with GitHub Releases when a window opens: at launch, and again if you reopen it from the menu bar.
Signed in adds three things: a license check, a scan summary, and a reachability check, an empty HEAD request to the same backend once a minute while the window is open. The summary is counts, sizes, timestamps, and a device identifier — nothing about the files themselves.
Never, in any state: your files, photos, file names, paths, thumbnails, or contents.
Signed out, Watching, when you turn it on, makes no network call at all. The only traffic is the version check when a window opens; with the window closed, nothing.

Every falsifiable promise we make, this one included, is catalogued with its disproving test on the claims ledger.

The 60-second version

One copy-paste command, run in Terminal while Vaulith scans. It lists every open network connection owned by Vaulith — the app process and the WebKit networking helper macOS gives it, which is where an app’s HTTPS requests actually happen. It refreshes every two seconds until you press Ctrl-C.

Quit Vaulith if it is open, then open Terminal (Applications → Utilities → Terminal) and paste this. It launches Vaulith itself — that is how it tells Vaulith’s networking helper apart from Safari’s or Mail’s:

Command — macOS

B=$(pgrep -f com.apple.WebKit.Networking | sort); open -a Vaulith; sleep 5; H=$(comm -13 <(echo "$B") <(pgrep -f com.apple.WebKit.Networking | sort) | paste -sd, -); P="$(pgrep -x vaulith | paste -sd, -)${H:+,$H}"; while true; do date; /usr/sbin/lsof -nP -a -i -p "$P" | tail -n +2 | grep . || echo "Vaulith: no open network connections"; echo; sleep 2; done
Start a scan. Stay signed out — the free tier lets you. Point it at your biggest, messiest folders. If you already run Ollama, let the AI analysis pass run too.
Read the output. While Vaulith reads and analyzes your disk, you should see this repeating:

Expected output — during a signed-out scan

Tue Aug 12 09:41:07 EDT 2026 Vaulith: no open network connections

Five things may legitimately appear, and only these:

When a window opens (at launch or when you reopen it from the menu bar, not during the scan): brief TLS connections to github.com and release-assets.githubusercontent.com — the version check, and the file it points to.
Also at launch, Windows only: one plain-HTTP fetch of a certificate revocation list from the update server’s certificate authority (today yr1.c.lencr.org, Let’s Encrypt). That is Windows checking the connection’s certificate, not Vaulith sending anything — it appears under Vaulith.exe because Windows performs that check inside the app’s own process. macOS runs the same check in its trustd system process, outside this command’s view.
If the app itself hits an internal error: the error screen offers a Send an anonymous report button, and a crash report leaves only if you click it. The report is path-scrubbed, at most five per session, never in development builds. Exactly what it contains is in the table below.
If local AI is installed: a row ending ->localhost:11434 (ESTABLISHED) — Vaulith talking to Ollama on your own machine, over loopback. That traffic never reaches the network.
If you’re signed in: brief connections to Vaulith’s backend for the license check, the scan summary and the once-a-minute reachability check. They appear on the networking helper, not the app process — which is why the command watches both.

Anything else is a finding — and we act on findings.

Prefer byte counts? Press Ctrl-C, then run this in the same Terminal window (it reuses the $P the command above computed). It prints total bytes in and out for the app and its helper. Run it before and after a scan and compare — sent bytes should stay in the kilobyte range, no matter how much disk was scanned:

Alternative — nettop byte counters

nettop -L 1 -J bytes_in,bytes_out $(echo "$P" | tr ',' '\n' | sed 's/^/-p /')

On Windows, PowerShell gives the same answer. Vaulith’s HTTPS requests are made by its WebView2 helper processes (msedgewebview2.exe), which are children of vaulith.exe — so the command collects the whole process tree first. During a signed-out scan it should report no matching connections (apart from the launch-time items listed above):

Command — Windows PowerShell

$ids = @((Get-Process vaulith).Id); $q = @($ids); while ($q.Count) { $p = $q[0]; $q = @($q | Select-Object -Skip 1); $k = @(Get-CimInstance Win32_Process -Filter "ParentProcessId=$p" | ForEach-Object ProcessId); $ids += $k; $q += $k }; while ($true) { Get-Date -Format T; $c = Get-NetTCPConnection -OwningProcess $ids -ErrorAction SilentlyContinue | Where-Object State -ne Listen; if ($c) { $c | Format-Table RemoteAddress,RemotePort,State,OwningProcess } else { "Vaulith: no open network connections" }; Start-Sleep 2 }

The deeper methods

The one-liner above is honest but coarse. These are the views a security researcher would trust. Same claim, stronger instruments.

Method 1 — Little Snitch (macOS, the clearest view)

Little Snitch is a per-app firewall. It shows every outbound connection an app attempts, live. Its free demo mode works for this test. So does LuLu, a free alternative from Objective-See.

Install Little Snitch and open its Network Monitor (menu-bar icon → Show Network Monitor).
Launch Vaulith and find it in the Network Monitor’s app list.
Run a full scan — point it at your biggest folders, and, if you already run Ollama, let the AI analysis pass run too.
Watch Vaulith’s connection list while it works.

What you should see: a version check to GitHub when the window opens. If you’re signed in, connections to Vaulith’s backend for the license check and scan summary. During the actual scanning and AI analysis: nothing new. Any AI exchange happens over loopback to Ollama, on your own machine. It never crosses the network interface at all.

With the window closed — the resident process

When Watching is on, Vaulith stays running after you close the window. This command lists that process’s open network connections every five seconds; leave it for an hour while you download, save and move files:

Command — macOS, window closed

P=$(pgrep -x vaulith); while true; do date; /usr/sbin/lsof -nP -a -i -p "$P" | tail -n +2 | grep . || echo "Vaulith: no open network connections"; echo; sleep 5; done

What you should see: “no open network connections”, every time. The version check runs only when a window opens, so with the window closed there is nothing to see. Our CI runs this loop for two minutes on every push to the main branch with the app started in tray mode, signed out, and fails the check on a single socket; the same run pins the physical footprint (Activity Monitor’s Memory column) under 40 MB.

Method 2 — Wireshark (macOS & Windows, the deep view)

Wireshark captures the raw traffic. Vaulith’s connections are TLS-encrypted, so you cannot read the payloads. That’s fine. The two things that would expose a lying cleaner are visible anyway: who it talks to, and how much it sends.

Install Wireshark and start a capture on your active interface (Wi-Fi or Ethernet).
Apply this display filter to see every DNS lookup and every TLS connection request, including the hostname each one is for:

dns || tls.handshake.type == 1

Run a full Vaulith scan, including the AI analysis pass if you run Ollama, and let it finish.
Check the hostname list against the table below — it should be that short.
Then check the volume: Statistics → Conversations, sort by bytes sent from your machine.

The arithmetic is the proof. A scan that reads hundreds of gigabytes off your disk should send kilobytes of traffic. You cannot hide gigabytes of uploads inside kilobytes. Encryption hides content; it cannot hide size. If Vaulith were exfiltrating your files, this one sort-by-bytes view would catch it every time.

One quirk worth knowing: the local AI traffic will not appear in this capture at all. Loopback traffic never reaches your Wi-Fi or Ethernet interface. To watch Vaulith talk to Ollama, start a second capture on the Loopback interface with the filter tcp.port == 11434. That is your files being analyzed, on your own machine, going nowhere.

Method 3 — Activity Monitor (macOS, zero install)

No tools, coarse but honest:

Open Activity Monitor (Applications → Utilities) and switch to the Network tab.
Find Vaulith in the process list and note its Sent Bytes.
Run a full scan and watch the number as gigabytes of disk are read.

Sent bytes should stay roughly flat, no matter how much disk the scan covers. Kilobytes, not gigabytes. On Windows, Resource Monitor (run perfmon /res, Network tab) shows the same per-process send totals.

What you should see — the complete list

When	Expected traffic
Signed out, scanning & AI analysis	Loopback only, and only if you run Ollama yourself: `127.0.0.1:11434` (Ollama, on your machine, never leaves it). Plus one version check with GitHub Releases when a window opens.
Signed in	The above, plus Vaulith’s backend — currently a `*.supabase.co` hostname, our infrastructure provider — for the license check, the scan summary (counts, sizes, timestamps, device identifier; a few kilobytes) and a reachability check once a minute (an empty HEAD request, no body).
Scanning iCloud/OneDrive-synced folders	No new cloud-provider download traffic — cloud-only (dataless) placeholder files are detected and skipped, never downloaded just to be inspected.
Downloading AI models into Ollama (one-time, only if you set Ollama up yourself)	Ollama fetches model weights from its registry (`ollama.com`). That’s gigabytes coming in — model weights — with nothing of yours going out.
If the app hits an internal error	Only if you click Send on the error screen: an anonymous crash report — the error type and a path-scrubbed message. Never your files, file names, paths, or account details.

Hostnames reflect our infrastructure as of August 2026 and may change as we grow; the shape of the traffic — and what’s never in it — is the promise.

What you should never see

Outbound volume that scales with your disk. Scanning 50 GB or 500 GB should make no difference to sent bytes.
Advertising or analytics domains. There are no ad networks or usage-analytics trackers in the app.
Uploads during the scan itself. Signed out, the scan and AI phases produce no new outbound connections at all (a crash report leaves only if you click Send on the error screen — see the table above).

Verify the download itself

Watching the wire proves what the app does. Checksums prove the app you’re running is the one we published. Every release on GitHub Releases ships with a SHA256SUMS.txt beside the installers. To check the copy you downloaded:

macOS — Terminal

cd ~/Downloads
curl -LO https://github.com/vaulith/vaulith-releases/releases/latest/download/SHA256SUMS.txt
shasum -a 256 -c SHA256SUMS.txt --ignore-missing

Expected output

Vaulith-mac.dmg: OK

On Windows, run certutil -hashfile Vaulith-windows.exe SHA256 in your download folder. Compare the printed hash against the matching line in SHA256SUMS.txt — identical, character for character. If a checksum ever fails, don’t run the installer. Re-download from GitHub Releases. If it still fails, tell us immediately.

Both installers are also signed. macOS builds are Developer ID–signed and notarized by Apple. Windows builds are Authenticode-signed by Vaulith LLC. Your operating system checks the publisher before anything runs. The signing identities are documented on the security page.

Checking the Windows signature from macOS or Linux with osslsigncode? Pass Microsoft’s Identity Verification Root Certificate Authority 2020 as the -CAfile — Mozilla-based trust stores omit that root, so without it the check reports a false failure. Windows trusts it natively.

Try to break it

This page is not an assurance. It is an invitation. Run the harshest instrument you own against the claim above, in any sign-in state, on any shipped build from v1.0.54 onward. Point Wireshark at the biggest scan you can construct. Diff the hostnames against the table. Sort by bytes sent. We built the app expecting you to do this.

And we stake the brand on it. Produce a reproducible packet capture of any shipped build from v1.0.54 onward transmitting file names, paths, thumbnails, or contents — in any sign-in state — and we treat it as a severity-one defect: fixed, publicly disclosed on the claims ledger, with named credit to you. The full terms, including safe harbor for good-faith research, are on the security page.

If you see something not on this list, we want to know immediately. Email support@vaulith.com with the subject SECURITY REPORT and what you captured — we treat it as a security incident, with the process described on our security page.

Run the test — it’s free

Download Vaulith, open a network monitor beside it, and scan your messiest drive. The free tier needs no account, so the signed-out test is the easiest to run. For everything that leaves your device and why, read how your privacy works. For every promise and its test, see the claims ledger.

Download Vaulith free