AtControl
Join the beta

Help · Security

How it stays yours

Two devices, two keys

Each install — every Mac, every phone — generates its own P-256 identity key and keeps it in the Keychain, marked never to sync. Nothing is trusted until a pairing says so.

Pairing

The Mac shows a 256-bit one-time secret as a QR code (or the same string as an atcontrol-pair: link), valid for ten minutes and five attempts. The phone proves it holds the secret by a MAC over both public keys with a key derived from it; the Mac verifies, countersigns the acceptance, and mints a random pairing id that names this relationship. There is deliberately no shorter code, no “6 digits”: nothing the peer sends may choose the key material.

From then on:

  • every command from the phone is signed with the phone’s key over a canonical, framed payload that names the target Mac and the pairing id; the Mac refuses one addressed elsewhere or issued under a pairing that has since been remade without answering (an answer would be a signature on a command it should never have seen); then it checks freshness and replay;
  • every status, journal and alert record from the Mac is signed with the Mac’s key, bound to record type and schema version; the phone refuses one that is unsigned or not its paired Mac’s;
  • the Mac’s result for a command is signed too, and the phone verifies it against its own copy of the command before clearing it.

The channel

Records live in the private database of your iCloud account — one zone per Mac — and are moved by Apple’s CloudKit. AtControl runs no server for this. The Mac app opens no network connection of its own: macOS system services do the talking.

What that gives you: integrity, from the app — nothing can be forged, redirected or replayed, in either direction. Confidentiality, from Apple — iCloud’s own protection of your private database.

What it is not: end-to-end encryption by AtControl. The records are plain JSON in your iCloud database. We say this on the phone’s Link row (“iCloud privacy · signed requests”), in the beta notes and in the privacy policy, and we will not word Apple’s storage protection as if it were device-only encryption. E2EE is the property of a transport where we hold the backend and can keep keys the server does not; that transport (a relay) is planned, not built, and will be labelled separately when it exists.

Consequence worth knowing: every device signed in to your iCloud account can reach that database. Pairing is still per device — a phone that has not completed the QR handshake holds no trusted key and can neither command nor read a signed status as trusted — but the account is the boundary.

Revocation

Symmetric and immediate. The Mac removes a phone’s key (Settings ▸ iPhone) and that phone’s commands are refused; the phone forgets a Mac and wipes its keys and cache. Each side also checks its pairing record at start and on refresh, so a deletion made while the other app was off is noticed rather than waited for.

iCloud holds the Mac’s data only while a phone is paired and syncing. When the last phone is unpaired — from either side — or iPhone sync is switched off, the Mac deletes its whole zone in iCloud. A phone keeps nothing about a Mac it is no longer paired with: when the Mac’s zone or its own pairing record disappears it erases that Mac’s status, journal and notifications without asking, and once no Mac is paired it erases everything, its keys included. While a pairing lasts, the Mac deletes what the phone no longer needs: answered commands after a day, alerts after two days, pairing requests after an hour.

Erasing everything

Settings ▸ Advanced ▸ Erase All Data on the Mac deletes everything AtControl keeps there — the journal and its statistics, the settings, the pairing keys and trusted phones, the agent token, the diagnostic log — and the Mac’s zone in iCloud, then quits. Every paired iPhone and iPad reads the zone’s disappearance as that Mac going away and erases what it holds about it, without asking; a phone paired with other Macs keeps those. If iCloud cannot be reached at that moment, the Mac is still erased and remembers only which zone to delete; it deletes it the next time AtControl runs with iCloud available. Shortcuts you added and setups in your agents live in their own apps and stay there.

Agent commands

Local only: Shortcuts or an atcontrol:// URL on the same Mac. Shortcuts takes no token: an App Intent can only be called by something already running as you, which could read any token file anyway. The URL scheme is off by default, because a web page, a link in mail or a document or a QR code can open a URL too. Switched on, it offers three kinds of protection:

  • Refuse links opened by apps (recommended, the default) — AtControl reads which program opened the URL from the macOS open-URL event, which a web page cannot forge (the browser is the sender), and refuses any app with a user interface: browsers, Mail, Messages, chat apps, Shortcuts’ “Open URL”. Command-line tools such as open pass; an unknown sender is refused. It does not stop a program already running as you from running open — the same exposure Shortcuts has — and a sandboxed app that runs open probably passes too (not verified).
  • Require a token — a per-install secret every URL must carry, which stops command-line tools as well. In a URL it is visible to any process that can list yours, and every agent using links must be given it.
  • No protection — a web page (after one browser confirmation), a link or a QR code can put the Mac to sleep, shut it down or keep it awake with the screen unlocked. Only for a Mac nobody else uses.

Refusals are silent to the caller and recorded in the journal. Task names are normalised before they are stored (control characters, line breaks and invisible direction or zero-width marks cannot reach the journal as such). Sessions are identified, not secret. The setup message you copy carries the token only when deeplinks are on and set to require it, and a cloud agent shows its conversation to its provider — Agents ▸ setup says so where you press the button.

Power actions

A sleep or shutdown from the phone or an agent is a request to macOS; the confirmation you see means it was accepted. Shutdown uses an Apple event to the login window. Sleep after an agent session waits for the last session. Nothing restores an agent’s blocking after a power action.

What is stored where

See the Privacy Policy §2–3, which lists it item by item.