macOS processes

What is syspolicyd on Mac?

syspolicyd is the system policy daemon. Gatekeeper is part of this policy. Gatekeeper does online checks when you open new apps.

Process: syspolicydApplies to: All current macOS versions. Seen on macOS 27.2.Checked: 29 October 2026

Where you see it

syspolicyd is in the list in Activity Monitor › Network, in nettop or in Kilobat.
A firewall or network monitor asks if syspolicyd can connect.
syspolicyd connects when you open an app that you downloaded.

What it is

The man page says that syspolicyd “embodies the system policy controlling what may be installed, loaded, executed”. Other parts of macOS ask it for the policy's verdict.

The spctl command manages the same security assessment policy.

Why it uses the network

Gatekeeper online checks. Apple says that Gatekeeper does online checks for known malware and for revoked developer certificates.
Notarization. Apple says that macOS Catalina and later need software to be notarized by default.

Is it normal?

Yes. Short connections when you open new or updated apps are usual.

Apple says that it does not combine data from these checks with information about users.

See how much it uses

Open Activity Monitor from Applications > Utilities. Click Network.
Type syspolicyd in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
In Terminal, watch only this process. Press d to show the change per second, and q to quit.
```
nettop -p syspolicyd -P
```

Reduce or pause it safely

There is no setting to reduce these checks safely. They are small.
Do not turn off Gatekeeper to save data. It protects the Mac against malware.
Do not quit syspolicyd in Activity Monitor. It is part of macOS, and other features depend on it.

With Kilobat

Open the Kilobat app list and search for syspolicyd. Its row shows the live rate and the bytes it moved.
In Terminal, see the same live list. Press / and type the name to search.
```
kilobat status --watch
```
Show its traffic over one day. Names match kilobat report --summary.
```
kilobat bandwidth syspolicyd day
```
Through MCP, an AI agent gets the same history with get_app_bandwidth and the name syspolicyd.
The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

Questions

Does Apple see every app I open?

Apple says that it does not log IP addresses for Developer ID certificate checks, and does not combine the data with user information.

Sources

syspolicyd(8) and spctl(8), man page installed with macOS 27.2
Apple Support: Safely open apps on your Mac
Apple Platform Security: Gatekeeper and runtime protection in macOS
nettop(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with man <name> in Terminal.