Built so your messages stay yours.

Data handling

• On-device first. Your messages live in Apple’s own Messages database on your Mac. autoMessage reads it locally and syncs a copy to your private cloud database so the dashboard, API, and AI tools can reach it.
• Verification codes are scrubbed before upload. Inbound messages that look like a 2FA or one-time code are redacted on your Mac, before the sync writes anything. Detection is deliberately conservative — it wants a 4–8 digit code plus a code-like phrase (“verification code”, “passcode”, “OTP”, “123456 is your…”), or an automated short-code sender. Phone numbers, prices, years and order numbers are not treated as codes. It covers inbound only, it’s on by default, and you can switch it off. Your Messages app and the local database are never modified — the code is hidden from the cloud, not lost.
• Encrypted in transit and at rest. All traffic is TLS-encrypted, and stored data is encrypted at rest by our cloud provider.
• Owner-scoped access rules. Your messages, conversations, drafts, and contacts each carry an owner reference, and database security rules deny any read or write that isn’t the record’s owner — enforced server-side, not just in the app.
• Contacts stay opt-in. Only the contacts relevant to your conversations are synced, to attach names and photos in your dashboard. Contact photos are stored in per-account storage that only you can read.
• You hold the keys — literally. Full Disk Access, Contacts, and Messages automation are macOS permissions you grant on your own machine and can revoke at any time in System Settings.

API & MCP security

• Per-request authentication. Every call carries your API key (X-API-KEY header or bearer token). Requests without a valid key are rejected before they touch any data.
• Instant key rotation. Regenerate your key from the dashboard whenever you need to — the previous key is revoked immediately.
• Rate limiting & abuse protection. The API and MCP endpoints throttle per client and reject malformed input, so a flood of bad requests can’t degrade service or brute-force keys.
• Strict transport & headers. HTTPS is enforced with HSTS; responses ship with content-type and content-security protections. There is no plaintext endpoint.
• Signed, SSRF-safe webhooks. Every webhook delivery is signed with a per-subscription secret (HMAC-SHA256) so you can verify it genuinely came from us and reject replays. Webhook URLs must be public HTTPS endpoints — private and internal addresses are refused, so the platform can’t be pointed at internal services.

The Mac app

• Notarized by Apple. The app is signed with our Apple Developer ID and notarized, so macOS Gatekeeper confirms it’s from a verified developer and hasn’t been tampered with.
• Hardened runtime. The app runs with Apple’s hardened runtime and only the entitlements it genuinely needs to read messages and send on your behalf.
• Signed automatic updates. Updates are delivered through a cryptographically signed feed (EdDSA) and verified before installing, so you can’t be served a malicious build.
• Read-only message access. autoMessage reads Apple’s Messages database read-only and never modifies it; outbound messages are sent through Apple’s own Messages app.

Common questions

Where are my iMessages stored?

They stay on your Mac, and a copy syncs to a private cloud database scoped to your account alone. Messages never touch a shared inbox or another customer’s data — every record is owned by your user, and access rules deny any read that isn’t yours.

Can an AI agent read my two-factor authentication codes?

No. autoMessage detects inbound verification and one-time codes and redacts them on your Mac before anything syncs, so the cloud copy, the REST API, the dashboard and any connected AI agent only ever see a placeholder. The real code stays in Messages.app on your device. Detection is conservative — it looks for a 4 to 8 digit code alongside a code-like phrase, or an automated short-code sender — so ordinary messages containing numbers are unaffected. The feature is on by default and can be turned off in Settings.

Does autoMessage use my own Apple ID?

Yes. autoMessage runs on the Mac you already own, using your own Apple ID and phone number. We never provision, hold, or share Apple IDs — so your account, your reputation, and your messages stay entirely under your control.

Is the Mac app safe to install?

The Mac app is signed with an Apple Developer ID and notarized by Apple, so macOS Gatekeeper verifies it opens without security warnings. Updates are cryptographically signed (EdDSA) and delivered in place, so you always run a verified build.

How do I rotate my API key?

Regenerate your API key any time from the dashboard. The old key stops working immediately, and the new one is shown once for you to store in your own secret manager.

Responsible disclosure

Found a security issue? We want to hear from you. Email security@automessage.app with details and steps to reproduce. We’ll acknowledge your report, keep you updated on the fix, and credit you if you’d like.