Local-first by construction
Conversations, memory, files, generated images, dictation and code all run on device. There is no Slate account, no server-side history, and no analytics or crash reporting. The only network calls are model downloads you start, the one-time Pro licence check, and any cloud connector you explicitly enable with your own key.
Open source you can audit
The engine behind Slate is public under the MIT licence. You do not have to trust a marketing claim: read the code, build it yourself, and watch the network. github.com/Lange-Co-Consulting/slate-engine.
Signed and notarized by Apple
Slate is distributed with an Apple Developer ID signature and the hardened runtime, and every release is notarized by Apple with the ticket stapled to both the app and the disk image. macOS verifies that signature before the app ever runs, so the download you get is provably the build we published and has not been tampered with in transit. It also means Slate opens with a normal double-click — you never have to right-click past an “unidentified developer” warning.
Verify your download
You do not have to take the paragraph above on faith. macOS already checks the signature for you, but you can confirm the exact bytes yourself. The current release is 1.0.0 (build 3), 50.3 MB:
shasum -a 256 Slate.dmg
f54344c3d20250791655c2480cc7008a1c69aad775326c2de85eaa7e921e3508
And to confirm Apple’s notarization ticket is attached and that Gatekeeper accepts the image:
xcrun stapler validate Slate.dmg
spctl --assess --type open --context context:primary-signature -v Slate.dmg
The second command must answer accepted and source=Notarized Developer ID. Every published checksum is also recorded in the signed update manifest that Slate itself uses to verify an update before installing it.
Secrets stay in the Keychain
Cloud API keys and the Pro licence key are stored in the macOS Keychain. They are never written into a settings export and never sent anywhere except the service they belong to.
Payments
Purchases run through our Merchant of Record. We never see or store your card details; payment data is handled by the payment provider under its own security program.
Reporting a vulnerability
If you believe you have found a security issue, please email info@lange-co-consulting.de with steps to reproduce. Please give us reasonable time to fix an issue before disclosing it publicly. We are grateful for responsible reports and will credit you if you would like.
Stand: Juli 2026 · See also the privacy policy.