Find My Apple · free
For a Mac that is gone.
- Shows the device on a map
- Plays a sound to help you find it
- Marks it as lost and locks it
- Erases it remotely
- Activation Lock stops reuse
Answers: where is it?
For macOS 15.5+ · Local-first · No account
Nothing, nothing, nothing — then something.
Signata is a tamper-evident flight recorder for your Mac. Arm it before you walk away, and every physical event that follows — a lid opened, a drive plugged in, a screen unlocked — is written to a log that can prove it wasn't altered afterwards.
One-time purchase. No subscription. Free updates for a year.
Where Signata fits
Three tools. Three different questions.
Find My and DoNotDisturb are both excellent, both free, and Signata competes with neither. Each answers a different question — and the one Signata answers is what happened while your Mac sat exactly where you left it.
DoNotDisturb Objective-See · free
For the moment a closed lid opens.
- Detects MacBook lid-open events
- Alerts locally and via a Telegram bot
- Optional webcam photo with a remote alert
- Runs a custom script on the event
- Keeps a local log of lid opens
Answers: was it opened?
Signata $19.99 once
For everything that happened while you were out.
- Wake, sleep, lock, unlock, USB, volumes, displays, audio
- Works on desktop Macs — no lid required
- Hash-chains the record so edits are detectable
- Published format and a standalone verifier
- Alerts via your own Telegram bot or HTTPS webhook
Answers: what happened, and can I prove it?
These stack. Running all three is the sensible setup.
What Signata deliberately doesn't do
Signata has no location code and never asks for location permission. It cannot lock your Mac, cannot erase it, and has no idea where in the world it is. That's Find My's job, and Find My does it well. Keep it switched on.
DoNotDisturb is free, open source, and from the most trusted name in Mac security. If an instant alert the moment a closed MacBook lid opens is what you need, install DND — it does that job well and it costs nothing. Signata isn't trying to replace it, and the overlap is real but narrow: both can send a Telegram alert, and both can take a webcam photo.
The difference is what happens either side of that moment. DND watches one signal on one kind of hardware, in its own words: "DND only works with laptops, and requires you to shut your laptop when you leave it unattended." Signata watches six kinds of physical event, on any Mac including a Mac mini or Studio that has no lid at all, and writes them into a record whose integrity you can verify independently afterwards.
A doorbell tells you someone knocked. A flight recorder tells you what happened.
The part that makes it evidence
A log anyone can edit isn't evidence.
Every entry carries a sequence number and the SHA-256 hash of the entry before it. Change one character anywhere in the history and the chain stops matching — and verification tells you exactly where it broke. Try it: tamper with an entry.
Click any entry to alter its contents.
The format is published
The chain specification is written down in full — field by field, with the exact verification algorithm — so anyone can implement against it.
The verifier is standalone
A dependency-free checker ships alongside it and validates a log without loading a line of Signata's code. Trust the maths, not the vendor.
It says what it can't do
The chain protects history, not the newest entry — nothing links to that one yet. The specification states this plainly rather than burying it.
A tamper-evidence claim that can't be independently verified isn't a claim.
The event surface
Six kinds of physical event, one normalized timeline.
Each trigger produces exactly one entry, with a timestamp, a summary and local context. Not just the lid — and not just laptops. Desktop Macs are covered the same way.
| Trigger | What gets recorded |
|---|---|
| Wake & sleep | System wake and sleep, with the wake reason classified so a Power Nap doesn't look like a person |
| Screen lock & unlock | Lock, unlock and session activation |
| USB attach & detach | Vendor ID, product ID, product name, and serial number where the device publishes one |
| Volumes | Mount and unmount — external drives, SD cards, disk images |
| Displays | Added and removed, with the display name where available |
| Audio output | Output device changes. Off by default, because Bluetooth headphones are noisy |
Evidence Mode Off by default
Optional camera snapshots and screenshots after a wake or unlock, each behind its own opt-in and its own macOS permission prompt. Evidence stays on your Mac — it is never attached to an alert. Signata will never combine hidden operation with capture.
Alerts you route yourself
Telegram with your own bot, or any HTTPS webhook — ntfy.sh, Discord, Slack, a Shortcut, your own endpoint. Credentials live in the Keychain. Queued while offline, retried when you're back. Nothing passes through infrastructure we operate, because there isn't any.
Read this before you buy
What Signata cannot do.
This section is a feature. Signata raises the cost of casual and opportunistic physical access — it is not a defense against a determined, resourced adversary, and you should know exactly where the edges are.
- While your Mac sleeps, Signata isn't running. It records from wake onward. Event ordering right around a wake is approximate.
- Alerts need a network. A machine kept offline delivers nothing. The local log is the durable artifact; remote alerts are best-effort.
- Pulling the drive defeats it. If FileVault stops someone authenticating, the next move is to remove the disk — and nothing is recorded.
- No failed-unlock detection. macOS exposes no sandbox-safe public API for wrong-password attempts. Lock, unlock and session activation are what's available.
- Hardware detail varies. USB serials and display names depend on what each device chooses to publish. Some report almost nothing.
- The chain protects history, not the newest entry. Nothing is linked to it yet. Closing that needs a signed or published chain head — planned, not shipped.
- Capture has physics. Lid closed, the camera sees nothing. Screen locked, a screenshot captures the login window.
Pricing
One purchase. No subscription.
$19.99
One-time · Free updates for a year
- Every feature. There is no Pro tier.
- Hash-chained log, published format, standalone verifier
- Evidence Mode and bring-your-own alerts included
- Runs on Apple silicon and Intel, macOS 15.5+
- No account, no telemetry, no server to depend on
Checkout isn't live yet — Signata is finishing its release candidate. Leave your email and you'll hear once, on launch day.
Questions
Straight answers.
Does Signata replace Find My?
No, and it can't. Find My locates a device that's been lost or stolen and can play a sound, mark it lost, or erase it. Signata does none of that. It records what happened to a Mac that's still exactly where you left it. Different questions, zero overlap — run both.
How does Signata compare to DoNotDisturb by Objective-See?
DoNotDisturb is free, open source, and from the most trusted name in Mac security. It detects the moment a closed MacBook lid is opened and alerts you locally, through a Telegram bot, or by running a script — optionally with a webcam photo. If that's what you need, install it.
Signata watches a wider surface and keeps a different kind of record. DND monitors lid-open events and, in its own words, "only works with laptops, and requires you to shut your laptop when you leave it unattended." Signata records wake, sleep, lock, unlock, USB, volumes, displays and audio output on any Mac — including a Mac mini or Studio with no lid at all — and hash-chains each entry so the history can be verified afterwards. Run both.
Does Signata track my Mac's location?
No. There's no location code in the app and it never requests location permission. It genuinely does not know where your Mac is. Location is Find My's job.
What does "tamper-evident" actually mean?
Each entry stores a sequence number and the SHA-256 hash of the previous entry's bytes as written to disk. Edit, delete or reorder anything and the chain stops matching, and verification names the entry where it broke. The format is published and the verifier is standalone, so you can check a log without trusting our binary.
Does anything leave my Mac?
Only if you set up an alert channel yourself, and only the event kind, local timestamp and summary. No account, no backend, no telemetry. Evidence files are never attached to alerts.
Will it use my camera?
Only if you enable Evidence Mode, which ships off, and only after macOS grants permission. Capture can never be triggered remotely, and hidden operation and capture are mutually exclusive by design.
Does it work on a Mac mini, Studio or iMac?
Yes. Signata's triggers are lid-independent, so desktops get the same coverage as laptops — wake, unlock, USB, volumes, displays and audio.
Is it on the Mac App Store?
No. Signata is distributed directly, signed with Developer ID and notarized by Apple. That keeps the door open for capabilities the sandbox forecloses, and means updates come from us rather than a review queue.