The agent watches outbound connections on your Mac. A tool with that job has to be specific about its own outbound connections, because “trust us” is not an answer a person can check.
This page lists every host the agent contacts, why, and what leaves your
machine when it does. It is the prose counterpart to the
PrivacyInfo.xcprivacy manifest shipped inside both the app and its system
extension.
This is why NSPrivacyCollectedDataTypes in the manifest is an empty array
rather than a short list. Apple defines collection as transmitting data off the
device where the developer or a third party can access it. By that definition
the agent collects nothing.
| Host | When | What is sent | What comes back |
|---|---|---|---|
| Your Hub (the address you entered) | Only after you enrol, and only if delivery is on | Connection metadata observed on this Mac: process, remote address and port, byte counts, timestamps. Never payload bytes | Acknowledgement; threat feed data; map locations for addresses you have already observed |
dl.egressview.com |
Update check on a schedule, and when you press Check for Updates | An ordinary HTTPS GET. No identifier, no account, no observation data | A release manifest, and the .pkg if you choose to install |
feodotracker.abuse.ch, threatfox.abuse.ch, urlhaus.abuse.ch, www.spamhaus.org |
Only if you turn on direct feed download, which is off when a Hub supplies feeds | An ordinary HTTPS GET for the whole public list. Your observations are not sent — matching happens on your Mac, against the downloaded list | The public indicator lists |
There is no fourth category. If you see the agent connecting somewhere not on this table, that is a bug worth reporting.
Contacting dl.egressview.com reveals your IP address to that host’s CDN, the
same way visiting any website does, and CloudFront writes access logs. That is
a property of making an HTTPS request at all, not something the agent adds. It
is listed here because a privacy page that only mentions the flattering facts is
not worth reading.
Nothing in that request identifies you beyond the request itself: there is no installation ID, no account, and no observation data attached.
The agent does not ask anybody whether an address is malicious. It downloads (or receives from your Hub) the public indicator lists and compares locally. The addresses you talked to are never sent to a threat-intelligence provider, because that would hand the thing being protected to a third party in order to protect it.
The globe places destinations you have already observed. Those lookups go to
your own Hub at api/agent/geo-cache, not to a geolocation service, and the
results are cached. If you have not enrolled with a Hub, the globe has nothing
to place and says so.
Apple asks apps to declare a reason for a small set of APIs that have been used for fingerprinting. The agent declares two categories, and this is what it uses them for:
| Category | Reason code | What the agent actually does |
|---|---|---|
| User defaults | CA92.1 |
Reads and writes its own settings — window state, refresh rate, language |
| User defaults | 1C8F.1 |
Shares settings with the system extension through the app group both belong to |
| File timestamp | C617.1 |
Reads the size of files it wrote itself: the observation journal and store in the app group container, and a downloaded update package in the app’s temporary directory |
The agent does not use the disk-space, system-boot-time, or active-keyboard categories. A repository test fails the build if a call to one of those appears in the source without a matching declaration, so this table cannot quietly go stale.
Everything above is observable without trusting this page:
# The manifest inside the installed app
plutil -p "/Applications/EgressView Agent.app/Contents/Resources/PrivacyInfo.xcprivacy"
# The same manifest inside the system extension
plutil -p "/Applications/EgressView Agent.app/Contents/Library/SystemExtensions/com.egressview.agent.filter.systemextension/Contents/Resources/PrivacyInfo.xcprivacy"
# That the app is notarised by Apple and unmodified since signing
spctl -a -vvv -t install "/Applications/EgressView Agent.app"
codesign --verify --deep --strict --verbose=2 "/Applications/EgressView Agent.app"
And, fittingly, you can point EgressView at the Mac running the agent and watch what the agent itself connects to.