Macaron
Security

How Macaron keeps your Mac safe

Last updated 25 October 2026

In plain words. Your iPhone talks straight to your Mac. Your password stays on your iPhone behind Face ID. We run no server between the two, so there is nothing of yours on our side to leak.

Audited. All clear.

Macaron went through Cloudflare's open-source security audit, run on Claude Opus 5.5 against the whole codebase: the iPhone app, the Mac app, the VPN tunnel, the widget and the alerts server. AI agents look for every way in, others try to disprove each lead, and only what holds is reported. Everything it raised is fixed, and the audit runs again before each major release.

Cloudflare
Security auditCloudflare's open-source audit, run on Claude Opus 5.5
Passed
Whole codebaseiPhone and Mac
Claude Opus 5.5Anthropic
All clearOctober 2026
  • Your iPhone's key only runs MacaronNo raw shell on your Mac, and your Mac password asked again behind Face ID.
  • Your router reached over pinned HTTPSNothing secret ever crosses your home network in clear.
  • One-time pairing codesA pairing code works once, for ten minutes, on your own Mac.
  • VPN keys revoked when you unpairA new key on demand, the old one deleted from your router.

Macaron is not affiliated with or endorsed by Cloudflare or Anthropic; we used their open tools.

Your password stays on your iPhone

To unlock FileVault, someone has to give your Mac its password. Macaron keeps it in your iPhone's Keychain, the same vault iOS uses for your own passwords, and reads it only after Face ID. It is saved as "this device only": never synced to iCloud, never restored to another phone. It is sent to one place: your own Mac, inside an encrypted connection. It is never sent to us, and there is no Macaron account that could hold it.

A key made on your iPhone

When you pair, your iPhone creates its own key and your Mac learns to trust it. Every gesture afterwards (opening an app, restarting, Remote Control) is signed by that key, so your password is needed only for the moments macOS itself asks for it: the FileVault screen and the login window.

Straight to your Mac, no cloud in between

At home, your iPhone reaches your Mac on your own network. Away from home, it goes through a VPN server that runs on your own router. Your screen, your files and your commands travel from your iPhone to your Mac and nowhere else. We could not read them if we wanted to.

The one thing our servers see

A Mac that has lost power can't warn anyone. To tell you it went down, the Mac app sends a small heartbeat every few minutes; when the heartbeats stop, we send a notification to your iPhone. That heartbeat carries a random identifier and a time, nothing else. Details are in the privacy policy.

What you should do too

  • Lock your iPhone with a passcode and Face ID. Whoever holds your unlocked iPhone holds your Mac.
  • Keep a backup of your Mac (Time Machine is enough). Remote Control and Terminal do exactly what you tell them.
  • Keep macOS and your router up to date.
  • If you lose your iPhone, delete its line from ~/.ssh/authorized_keys on your Mac (the Macaron Mac app lists your paired iPhones in Settings), and change your Mac password.

Found a problem?

Write to hello@getmacaron.app with "Security" in the subject. We read every report and answer quickly.