--- title: "syspolicyd: what it is, why it connects to Apple, and whether to block it · Kilobat" url: "https://kilobat.app/processes/syspolicyd" description: "syspolicyd runs Gatekeeper on a Mac and checks new apps online. What its small connections to Apple are, and why blocking them weakens malware protection." --- Security and accounts # What is syspolicyd? `syspolicyd` is the system policy daemon. Gatekeeper is part of this policy, and it does online checks when you open new apps, so `syspolicyd` makes short connections to Apple. Process: `syspolicyd` · Made by Apple · Applies to: macOS 14 Sonoma and later. Checked on macOS 27.2. · Checked: 1 November 2026 ## Short answer Part of macOS. It runs the system policy that includes Gatekeeper, which checks new and changed apps for known malware and revoked certificates. Don’t block Don't block it. Gatekeeper's online checks protect the Mac against known malware and revoked apps. Path `/usr/libexec/syspolicyd` launchd label `com.apple.security.syspolicy` Signing identifier `com.apple.syspolicyd` ## What it is The man page says that `syspolicyd` “embodies the system policy controlling what may be installed, loaded, executed”. Other parts of macOS ask it for the policy's verdict. The `spctl` command manages the same security assessment policy. launchd starts the daemon as `com.apple.security.syspolicy`. Apple Platform Security says that, by default, all software is checked for known malicious content the first time it is opened. Gatekeeper checks that downloaded software is signed and notarized. ## Why it uses the network - **Gatekeeper online checks.** Apple says that Gatekeeper does online checks for known malware and for revoked developer certificates. - **Notarization.** Apple lists `api.apple-cloudkit.com` for app notarization. Apple also says that macOS checks for new revocation tickets regularly, in the background. ## How much is normal Short connections when you open new or updated apps are usual. They are small. Apple says that revocation checks happen in the background, much more often than XProtect updates. Apple says that it doesn't combine data from these checks with information about users. A notarized app usually carries its ticket inside it, so Gatekeeper can verify it even offline. ## When it uses a lot, and why - **Many new apps at once.** Installing many apps, or a tool that unpacks many executables, can make many first-launch checks. - **Never large.** Each check is small. Large traffic under `syspolicyd` isn't expected; measure it with the steps below. ## Is it safe to block? Don’t block Don't block it. Gatekeeper's online checks protect the Mac against known malware and revoked apps. What breaks if you block it - Gatekeeper can't check new apps online for known malware or revoked developer certificates. - Revocation tickets for malicious apps may not reach this Mac. - Opening a new app can take longer while the check waits for the network. Blocking means a firewall rule that refuses its connections. Don’t quit or disable a macOS process to save data: macOS starts it again, and other features depend on it. ## Reduce its use 1. There is no setting to reduce these checks safely. They are small. 2. Don't turn off Gatekeeper to save data. It protects the Mac against malware. 3. Don't quit `syspolicyd` in Activity Monitor. macOS starts it again. ## See how much it uses 1. Open Activity Monitor from Applications › Utilities. Click Network. 2. Type `syspolicyd` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved since it started. 3. In Terminal, watch only this process. Press d to show the change per second, and q to quit. ``` nettop -p 'syspolicyd' -P ``` ## With Kilobat 1. In the Kilobat app list, search for `syspolicyd`. Its row shows the live rate and what it moved today. 2. In Connections, click the ⓘ button on one of its rows. The popover shows this page’s short answer, without going online. 3. In Terminal, ask the same question. Add `--json` for scripts and agents. ``` kilobat explain 'syspolicyd' ``` 4. Show its traffic over one day. ``` kilobat bandwidth 'syspolicyd' day ``` 5. Through MCP, an AI agent asks `explain_connection` with the process name. It gets the same facts. The live view and the explanations are free. History in the app needs Kilobat Pro. Blocking needs Pro and the network filter: see the [network filter](https://kilobat.app/docs/blocking#filtering), [Protection](https://kilobat.app/docs/blocking#protection) and the [hotspot data saver](https://kilobat.app/save-hotspot-data). ## Hosts it contacts Apple and the maker document these hosts for this feature. A process can also contact others; Kilobat’s Connections tab shows what it actually opens on your Mac. - [*.apple-cloudkit.com](https://kilobat.app/hosts/apple-cloudkit-com): Apple's CloudKit service. Apps sync their iCloud data through it, and Apple lists api.apple-cloudkit.com for app notarization on macOS. ## Questions **Does Apple see every app I open?** Apple says that it doesn't log IP addresses for Developer ID certificate checks, and doesn't combine the data with user information. **Why is opening a new app slow without internet?** Gatekeeper checks new apps online when it can. A notarized app with a stapled ticket can still open offline, Apple says. ## Sources - syspolicyd(8) and spctl(8), man pages installed with macOS 27.2 - launchd property list com.apple.security.syspolicy, macOS 27.2 - [Apple Support: Safely open apps on your Mac](https://support.apple.com/en-us/102445) - [Apple Platform Security: Gatekeeper and runtime protection in macOS](https://support.apple.com/guide/security/gatekeeper-and-runtime-protection-sec5599b66df/web) - [Apple Platform Security: Protecting against malware in macOS](https://support.apple.com/guide/security/protecting-against-malware-sec469d47bd8/web) - [Apple Support: Use Apple products on enterprise networks](https://support.apple.com/en-us/101555) Checked on 1 November 2026. ## Related - [trustd](https://kilobat.app/processes/trustd): Part of macOS. It checks certificates for every app, and asks certificate authorities whether a certificate was revoked. Its connections are small. - [cloudd](https://kilobat.app/processes/cloudd): Part of macOS. It syncs the iCloud data of apps that use CloudKit, so its traffic belongs to those apps.