🔒 What Happens on Your Mac
PhantomProtect will use Apple's Network Extension and Endpoint Security frameworks, which give approved apps controlled access to network and file events. It will evaluate connection details, apply local DNS filtering, and scan supported files without sending your browsing traffic through a PhantomSecure VPN server. Threat-intelligence updates and other required service traffic are separate, and we'll document them before release.
On-Device Protection
The background Agent will make live decisions using local rules and downloaded threat intelligence. The main PhantomSecure app will show activity and let you adjust protection, but it will not run the live defense itself.
- ✓ Check Locally: Connection and domain checks will use rules stored on your Mac.
- ✓ PhantomWatch Dashboard: The main app is planned to show connection activity and approximate destinations.
- ✓ Update Local Threat Data: Downloaded intelligence will support local lookups without a remote request for every event.
- ✓ Keep Telemetry Optional: Product telemetry will stay off until you explicitly opt into that category.
File Scanning and Threat Intelligence
Planned file protection combines system file events, local rules, and multiple threat-intelligence sources. Results will be shown with enough context to help you decide what to do next.
- ✓ YARA-X Rules: Planned on-device scanning for supported files and file events.
- ✓ Combine Threat Sources: Curated threat data is planned to cover domains, addresses, URLs, and known malicious files.
- ✓ No PhantomSecure VPN: The planned design does not route your browsing traffic through a remote VPN service run by PhantomSecure.
- ✓ Heuristics With Limits: Planned heuristics will add context to known indicators, not claim to identify every new threat.
Choose a Protection Profile
Planned profiles will let you choose how PhantomProtect handles notifications, performance, and protection for common activities.
- ✓ Gaming Mode: Reduce nonessential alerts and work that could affect latency
- ✓ Work Mode: Use the default balance of protection and notifications
- ✓ Browsing Mode: Apply a stricter profile to web activity and downloads
- ✓ Telemetry Stays Separate: Choosing a profile will not opt you into optional telemetry
