Where are my iMessages stored?

They stay on your Mac, and a copy syncs to a private cloud database scoped to your account alone. Messages never touch a shared inbox or another customer’s data — every record is owned by your user, and access rules deny any read that isn’t yours.

Does autoMessage use my own Apple ID?

Yes. autoMessage runs on the Mac you already own, using your own Apple ID and phone number. We never provision, rent, or share Apple IDs — so your account, your reputation, and your messages stay entirely under your control.

Is the Mac app safe to install?

The Mac app is signed with an Apple Developer ID and notarized by Apple, so macOS Gatekeeper verifies it opens without security warnings. Updates are cryptographically signed (EdDSA) and delivered in place, so you always run a verified build.

How do I rotate my API key?

Regenerate your API key any time from the dashboard. The old key stops working immediately, and the new one is shown once for you to store in your own secret manager.

Security

Built so your messages stay yours.

autoMessage is a bring-your-own-device platform: it runs on the Mac you own, using the Apple ID you already have. Your iMessages never route through a data-center Mac or a shared account. Below is how we keep your data and your API access safe.

Your Mac, your Apple ID

autoMessage runs on hardware you own with the Apple ID you already use. We never rent you a Mac in a data center or hand you a stranger’s phone number. Messages send as you, from your number — and your account’s reputation stays yours.

Per-account data isolation

Every conversation, message, draft, and contact is owned by your account. Database access rules reject any request that can’t prove it belongs to the signed-in user — there is no shared inbox and no path to another customer’s data.

Signed, notarized, auto-updating

The Mac app is Developer ID–signed, notarized by Apple, and runs under the hardened runtime. Updates are EdDSA-signed and verified before install, so you always run an authentic build — no unsigned downloads, no manual patching.

Hardened API surface

The REST API and MCP server are HTTPS-only, authenticated per request, rate-limited, and served with strict security headers (HSTS, content-type protection, a locked-down content security policy). Phone numbers are normalized at the write boundary so bad input never reaches storage.

Data handling

On-device first. Your messages live in Apple’s own Messages database on your Mac. autoMessage reads it locally and syncs a copy to your private cloud database so the dashboard, API, and AI tools can reach it.
Encrypted in transit and at rest.All traffic is TLS-encrypted, and stored data is encrypted at rest by our cloud provider.
Owner-scoped access rules. Your messages, conversations, drafts, and contacts each carry an owner reference, and database security rules deny any read or write that isn’t the record’s owner — enforced server-side, not just in the app.
Contacts stay opt-in. Only the contacts relevant to your conversations are synced, to attach names and photos in your dashboard. Contact photos are stored in per-account storage that only you can read.
You hold the keys — literally.Full Disk Access, Contacts, and Messages automation are macOS permissions you grant on your own machine and can revoke at any time in System Settings.

API & MCP security

Per-request authentication. Every call carries your API key (X-API-KEY header or bearer token). Requests without a valid key are rejected before they touch any data.
Instant key rotation. Regenerate your key from the dashboard whenever you need to — the previous key is revoked immediately.
Rate limiting & abuse protection.The API and MCP endpoints throttle per client and reject malformed input, so a flood of bad requests can’t degrade service or brute-force keys.
Strict transport & headers.HTTPS is enforced with HSTS; responses ship with content-type and content-security protections. There is no plaintext endpoint.
Signed, SSRF-safe webhooks. Every webhook delivery is signed with a per-subscription secret (HMAC-SHA256) so you can verify it genuinely came from us and reject replays. Webhook URLs must be public HTTPS endpoints — private and internal addresses are refused, so the platform can’t be pointed at internal services.

The Mac app

Notarized by Apple. The app is signed with our Apple Developer ID and notarized, so macOS Gatekeeper confirms it’s from a verified developer and hasn’t been tampered with.
Hardened runtime. The app runs with Apple’s hardened runtime and only the entitlements it genuinely needs to read messages and send on your behalf.
Signed automatic updates. Updates are delivered through a cryptographically signed feed (EdDSA) and verified before installing, so you can’t be served a malicious build.
Read-only message access. autoMessage reads Apple’s Messages database read-only and never modifies it; outbound messages are sent through Apple’s own Messages app.

Responsible disclosure

Found a security issue? We want to hear from you. Email security@automessage.app with details and steps to reproduce. We’ll acknowledge your report, keep you updated on the fix, and credit you if you’d like.

Your Mac. Your Apple ID. Your data.

Try autoMessage with a 7-day free trial — no data center, no shared account.

Start free trial