Security and accounts

What is syspolicyd?

syspolicyd is the system policy daemon. Gatekeeper is part of this policy, and it does online checks when you open new apps, so syspolicyd makes short connections to Apple.

Process: syspolicydMade by AppleApplies to: macOS 14 Sonoma and later. Checked on macOS 27.2.Checked: 1 November 2026

Short answer

Part of macOS. It runs the system policy that includes Gatekeeper, which checks new and changed apps for known malware and revoked certificates.

Don’t block

Don't block it. Gatekeeper's online checks protect the Mac against known malware and revoked apps.

Path
/usr/libexec/syspolicyd
launchd label
com.apple.security.syspolicy
Signing identifier
com.apple.syspolicyd

What it is

The man page says that syspolicyd “embodies the system policy controlling what may be installed, loaded, executed”. Other parts of macOS ask it for the policy's verdict.

The spctl command manages the same security assessment policy. launchd starts the daemon as com.apple.security.syspolicy.

Apple Platform Security says that, by default, all software is checked for known malicious content the first time it is opened. Gatekeeper checks that downloaded software is signed and notarized.

Why it uses the network

  • Gatekeeper online checks. Apple says that Gatekeeper does online checks for known malware and for revoked developer certificates.
  • Notarization. Apple lists api.apple-cloudkit.com for app notarization. Apple also says that macOS checks for new revocation tickets regularly, in the background.

How much is normal

Short connections when you open new or updated apps are usual. They are small.

Apple says that revocation checks happen in the background, much more often than XProtect updates.

Apple says that it doesn't combine data from these checks with information about users.

A notarized app usually carries its ticket inside it, so Gatekeeper can verify it even offline.

When it uses a lot, and why

  • Many new apps at once. Installing many apps, or a tool that unpacks many executables, can make many first-launch checks.
  • Never large. Each check is small. Large traffic under syspolicyd isn't expected; measure it with the steps below.

Is it safe to block?

Don’t block

Don't block it. Gatekeeper's online checks protect the Mac against known malware and revoked apps.

What breaks if you block it

  • Gatekeeper can't check new apps online for known malware or revoked developer certificates.
  • Revocation tickets for malicious apps may not reach this Mac.
  • Opening a new app can take longer while the check waits for the network.

Blocking means a firewall rule that refuses its connections. Don’t quit or disable a macOS process to save data: macOS starts it again, and other features depend on it.

Reduce its use

  1. There is no setting to reduce these checks safely. They are small.

  2. Don't turn off Gatekeeper to save data. It protects the Mac against malware.

  3. Don't quit syspolicyd in Activity Monitor. macOS starts it again.

See how much it uses

  1. Open Activity Monitor from Applications › Utilities. Click Network.

  2. Type syspolicyd in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved since it started.

  3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

    nettop -p 'syspolicyd' -P

With Kilobat

  1. In the Kilobat app list, search for syspolicyd. Its row shows the live rate and what it moved today.

  2. In Connections, click the ⓘ button on one of its rows. The popover shows this page’s short answer, without going online.

  3. In Terminal, ask the same question. Add --json for scripts and agents.

    kilobat explain 'syspolicyd'

  4. Show its traffic over one day.

    kilobat bandwidth 'syspolicyd' day

  5. Through MCP, an AI agent asks explain_connection with the process name. It gets the same facts.

The live view and the explanations are free. History in the app needs Kilobat Pro. Blocking needs Pro and the network filter: see the network filter, Protection and the hotspot data saver.

Hosts it contacts

Apple and the maker document these hosts for this feature. A process can also contact others; Kilobat’s Connections tab shows what it actually opens on your Mac.

*.apple-cloudkit.comApple's CloudKit service. Apps sync their iCloud data through it, and Apple lists api.apple-cloudkit.com for app notarization on macOS.Apple →

Questions

Does Apple see every app I open?

Apple says that it doesn't log IP addresses for Developer ID certificate checks, and doesn't combine the data with user information.

Why is opening a new app slow without internet?

Gatekeeper checks new apps online when it can. A notarized app with a stapled ticket can still open offline, Apple says.

Sources

Checked on 1 November 2026.