Summary

SecureEdge is a native Swift app for iPhone and iPad that runs open-weight language models on the device's GPU. It has no account system and no third-party SDKs. The managed build distributed to organizations contains no networking code. The App Store build contains exactly one network feature, model downloads, which run only when the user asks for one. Policy arrives through Apple managed app configuration. Model files arrive as signed bundles, whether pushed by MDM or downloaded at the user's request. Everything the app stores is encrypted at rest with iOS Data Protection class Complete, and everything it does is recorded in a hash-chained audit log that verifies on the device and can be re-verified independently after export.

Scope. SecureEdge is designed for controlled unclassified information on managed devices. It is not a classified system and is not positioned as one. It holds no FedRAMP authorization, ATO, or CMMC certification; the controls below are offered to support your own assessment.

Network: managed versus App Store builds

SecureEdge ships as two builds, and the difference between them is the network.

The managed build, distributed to organizations through Apple Business Manager and MDM, contains no networking code. There is no URLSession, no NWConnection, no WKWebView, no CloudKit, no push registration. A build-time test scans every source file in the app target for those symbols and fails the build if any appear, and inspecting the compiled binary shows it links no URLSession symbols. App Transport Security additionally forbids arbitrary loads. Model bundles are delivered out of band, by MDM asset push, Files, or a pilot build, and are never fetched. The practical test is simple: put the phone in airplane mode. Nothing changes.

The App Store build, which the public listing ships, contains exactly one networking feature: optional model downloads. Nothing is fetched automatically, ever. The catalog of available models is requested only when the user opens the download list in the Models screen, and a model file is requested only when the user taps Download for that model. The request is a standard HTTPS GET to the SecureEdge model catalog, served by Amazon CloudFront and Amazon S3 in the AWS us-east-2 region. It carries no account, no device identifier, no telemetry, and no user content; the only app-added header is a User-Agent of the form SecureEdge/<version>. Access logging on the model server is disabled, so we retain no per-request records. A downloaded file is streamed through SHA-256 and its manifest signature verified before it can be loaded; a mismatch deletes the file. Downloads may continue in the background, and a local notification reports completion. Organizations can turn downloads off with allowModelDownloads or point the app at their own catalog with modelCatalogURL.

Common to both builds:

No automatic downloads and no background fetches. The only request the App Store build can make is one the user just asked for; the managed build cannot make one at all.
No telemetry, analytics, or crash-reporting SDKs. Crash reports stay on the device under Apple's own controls.
No cloud inference and no cloud fallback. If the device cannot run a model, the model is not loaded. Prompts and documents are never sent anywhere.
No remote push notifications. The app uses local notifications only; there is no APNs registration.

Encrypted at rest

The database, imported documents, transcripts, chat history, model cache, and any quarantined files live under the app's Application Support directory with Data Protection class Complete. That class keeps the files inaccessible whenever the device is locked; the keys are derived through the Secure Enclave from the device passcode. All of these locations are excluded from iCloud and iTunes backups.

Cryptography is Apple's. Signature verification and hashing use CryptoKit. The app does not ship its own cryptographic primitives, which keeps the FIPS boundary where your platform documentation already puts it.

Signed model bundles

A model bundle is a folder holding a manifest.json and the model file it names. The manifest carries the model id, version, minimum RAM, license, SHA-256 of the model file, and an Ed25519 signature over the manifest. On every load, not just the first, the app:

Verifies the manifest signature against the public keys in trustedSigningKeys from MDM policy (falling back to a development key only when no policy is present).
Streams the model file through SHA-256 and compares it to the manifest.
Refuses the bundle if either check fails, and writes the refusal to the audit log.

Bundles reach the device in one of four ways: compiled into a pilot build, pushed by MDM as a managed asset into the app's Documents folder, copied there through Files, or, in the App Store build only, downloaded from the model catalog when the user taps Download. The managed build cannot download one. A downloaded bundle passes the same signature and hash checks as any other, and a file that fails them is deleted. Only one model is resident in memory at a time; the manager unloads the current model before loading another.

Organizations generate their own signing keys with the seadmin command-line tool, sign bundles with a private key that never touches the device, and distribute the public key through policy. Rotating a key is a policy push.

Audit chain

Every policy load, model load or refusal, prompt, response, dictation, import, workflow run, export, screenshot, screen-recording start, and retention purge is an entry in a SHA-256 hash chain stored in the encrypted database. Each entry includes the hash of the entry before it. Editing, deleting, or reordering any entry breaks verification from that point forward.

Verify on device. Settings ▸ Audit log walks the chain and reports the first break, if any.
Export. When allowAuditExport is true, the log exports as JSON Lines for the security officer.
Verify independently. seadmin audit-verify re-checks an export on a workstation without the device.

Prompt and response entries record that the event happened, with character counts, elapsed time, the workflow name, and the model in use. The audit log does not store the text of prompts or responses; that text lives in the conversation store and is governed by the retention policy.

MDM policy keys

The app reads Apple managed app configuration (com.apple.configuration.managed) and never writes anything back. Any MDM that supports managed app configuration works: Intune, Jamf, Ivanti, Workspace ONE, and others. No in-app setting can loosen a value set here.

Key	Type	Default	Meaning
`allowedModels`	array of string	`[] (all verified)`	Model ids the user may load.
`requireSignedModels`	bool	`true`	Refuse unsigned or untrusted manifests.
`trustedSigningKeys`	array of string	`[] (dev key)`	Base64 Ed25519 public keys that may sign bundles.
`retention`	string	`30d`	session, 24h, 30d, or indefinite.
`allowDictation`	bool	`true`	On-device speech input.
`allowImageInput`	bool	`true`	Photos, screenshots, camera.
`allowFileImport`	bool	`true`	Library imports and model bundle imports.
`allowCustomWorkflows`	bool	`true`	User-authored workflows.
`allowExport`	bool	`true`	Exporting chats, transcripts, and documents.
`allowAuditExport`	bool	`true`	Exporting the audit log as JSON Lines.
`allowNotifications`	bool	`true`	Local notifications only.
`allowModelDownloads`	bool	`true`	App Store build only: whether the user may download models from the catalog. Managed builds ignore it; they have no download code.
`modelCatalogURL`	string (HTTPS URL)	`"" (SecureEdge catalog)`	App Store build only: serve the model catalog from your own HTTPS server instead of ours. Managed builds ignore it.
`allowCopy`	bool	`true`	Clipboard.
`customVocabulary`	array of string	`[]`	Call signs, place names, acronyms for the recognizer and cleanup prompt.
`organizationName`	string	`""`	Shown in Settings.

seadmin mdm-config emits a ready-to-upload plist for Jamf, Ivanti, or Workspace ONE, or a flat JSON object for Intune's configuration designer.

Fail-closed policy

With no configuration present, the app runs with development defaults and says so in Settings. A configuration that is present but malformed puts the app into a restricted mode: no dictation, no image input, no imports, no export, and no model loading, until a valid configuration arrives. A broken push can narrow access but can never widen it.

Retention

The administrator sets retention with the retention key; the user cannot change it.

Value	Behavior
`session`	Chats, transcripts, and imported documents are purged when the session ends.
`24h`	Artifacts older than 24 hours are purged on the next enforcement pass.
`30d`	Artifacts older than 30 days are purged. This is the default.
`indefinite`	Nothing is purged automatically. The user may still delete items.

Each purge is itself an audit entry. Model files are not user artifacts and are not affected by retention.

Screenshots and recording

An app on iOS cannot block screenshots; only an MDM restriction can, at the device level. What the app can do, it does: every screenshot and every screen-recording start while SecureEdge is in the foreground is written to the audit log so the security officer can see it. Clipboard access is governed by allowCopy.

What the app does not do

No automatic downloads or background fetches. The App Store build connects only when the user opens the download list or taps Download; the managed build has no networking code and never connects.
No analytics, telemetry, or usage metrics of any kind.
No crash-reporting SDK. No third-party SDKs at all.
No remote push notifications and no APNs registration.
No cloud inference and no cloud fallback for any model, feature, or language.
No accounts, sign-in, or identity provider. The device and its MDM enrollment are the identity.
No advertising identifiers, fingerprinting, or tracking.
No writing back to the MDM. Policy is read-only from the app's side.
No fine-tuning or training on device. Models are inference-only.

Runtime and models

The inference runtime is Google's LiteRT-LM, running Gemma 4 and Gemma fine-tunes from .litertlm files on the Metal GPU. The Swift wrapper is vendored into the repository, pinned to a specific upstream release, and fetches its binary by SHA-256 checksum, so the compliance package can reference one fixed, auditable runtime artifact. Gemma is open-weight under Google's Gemma Terms of Use; the catalog will always include an Apache 2.0 model so no buyer is blocked by that license. The models currently offered for download in the App Store build are Gemma 4 E2B and Gemma 4 E4B in LiteRT-LM format, redistributed under the Gemma Terms of Use. Model selection is a policy decision made with allowedModels.

Model output is assistance. It can be wrong, and operational decisions remain with the user and the chain of command. See the Terms of Use.

Responsible disclosure

If you believe you have found a vulnerability in SecureEdge, the signing tooling, or this website, email babs@wanyekitech.com with a description, the affected version, and steps to reproduce. We acknowledge reports within five business days, keep you informed while we work on a fix, and credit reporters who want it. We ask that you give us reasonable time to remediate before public disclosure and that you do not access data that is not yours.