---
title: "syspolicyd on Mac: Gatekeeper checks and network use · Kilobat Guides"
url: "https://kilobat.app/guides/what-is-syspolicyd.html"
description: "syspolicyd is the macOS system policy daemon behind Gatekeeper. Learn why it connects to Apple when you open new apps, and why it is normal."
---

macOS processes

# What is syspolicyd on Mac?

`syspolicyd` is the system policy daemon. Gatekeeper is part of this policy. Gatekeeper does online checks when you open new apps.

Process: `syspolicyd` · Applies to: All current macOS versions. Seen on macOS 27.2. · Checked: 29 October 2026

## Where you see it

- `syspolicyd` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat.
- A firewall or network monitor asks if `syspolicyd` can connect.
- `syspolicyd` connects when you open an app that you downloaded.

## What it is

The man page says that syspolicyd “embodies the system policy controlling what may be installed, loaded, executed”. Other parts of macOS ask it for the policy's verdict.

The `spctl` command manages the same security assessment policy.

## Why it uses the network

- **Gatekeeper online checks.** Apple says that Gatekeeper does online checks for known malware and for revoked developer certificates.
- **Notarization.** Apple says that macOS Catalina and later need software to be notarized by default.

## Is it normal?

Yes. Short connections when you open new or updated apps are usual.

Apple says that it does not combine data from these checks with information about users.

## See how much it uses

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Type `syspolicyd` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

   ```
   nettop -p syspolicyd -P
   ```

## Reduce or pause it safely

1. There is no setting to reduce these checks safely. They are small.
2. Do not turn off Gatekeeper to save data. It protects the Mac against malware.
3. Do not quit `syspolicyd` in Activity Monitor. It is part of macOS, and other features depend on it.

## With Kilobat

1. Open the Kilobat app list and search for `syspolicyd`. Its row shows the live rate and the bytes it moved.
2. In Terminal, see the same live list. Press / and type the name to search.

   ```
   kilobat status --watch
   ```
3. Show its traffic over one day. Names match `kilobat report --summary`.

   ```
   kilobat bandwidth syspolicyd day
   ```
4. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `syspolicyd`.
5. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

## Questions

**Does Apple see every app I open?**

Apple says that it does not log IP addresses for Developer ID certificate checks, and does not combine the data with user information.

## Sources

- syspolicyd(8) and spctl(8), man page installed with macOS 27.2
- [Apple Support: Safely open apps on your Mac](https://support.apple.com/en-us/102445)
- [Apple Platform Security: Gatekeeper and runtime protection in macOS](https://support.apple.com/guide/security/gatekeeper-and-runtime-protection-sec5599b66df/web)
- nettop(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

## Related guides

- [What is trustd on Mac?](https://kilobat.app/guides/what-is-trustd.html): trustd checks certificates for all processes on the Mac.
- [Little Snitch, LuLu and other network extensions conflict on a Mac](https://kilobat.app/guides/network-extension-conflicts.html): Firewalls, VPNs and content filters on macOS use network extensions.
- [Find which app uses your bandwidth on a Mac](https://kilobat.app/guides/which-app-uses-bandwidth.html): Activity Monitor and nettop show which processes send and receive data.