Where Outbound keeps its data

Outbound keeps its configuration and records in a small number of places. The rule store, settings and audit log live in the app group container so the app, the background agent and outboundctl all see the same files; per-app data lives under Application Support and Caches. Uninstalling removes the app group container; see Uninstalling for exactly what is deleted.

The app group container

All shared state lives here:

~/Library/Group Containers/5GS535L4GD.com.outboundfirewall.outbound/
├── rules.json            the rules, with rules.json.bak and rules.json.lock beside it
├── settings.json         the settings, with settings.json.lock beside it
├── review.json           connections waiting in Review
├── widget.json           data for the Outbound widgets
├── widget-icons/         app icons for the widgets
├── Analytics/
│   └── analytics.sqlite  analytics rollups (per-hour and per-country), encrypted
├── Locations/            the location database for the map (about 60 MB)
└── audit/
    └── 2026-10-19.0.jsonl  the agent's copy of the sealed audit log

This is the store. OUTBOUND_STORE_PATH can point the rule store somewhere else; when set, settings.json, review.json, the Analytics database and the audit folder follow it, so a relocated store relocates everything that belongs to it. The format of the first three files is documented in The rules file format, and the audit log in Audit log export. The sealed log itself, the one exports read, is in the filter’s folder /var/root/Library/Application Support/com.outboundfirewall.outbound.filter/audit, readable only by root.

When a command runs as root (sudo, an MDM post-install script) without OUTBOUND_STORE_PATH, the tool uses the container of the user signed in at the console instead, and stops with an error when nobody is. Symlinked overrides are resolved once; settings, backups and locks live beside the canonical rules file.

Encrypted history

Connection history, the analytics rollups, the traffic history behind the charts and the rule usage counts are encrypted on disk. History files use AES-GCM, and the databases use SQLCipher. The key is created on this Mac, kept in your Keychain (see Keychain below), and never leaves it. A copy of these files on another Mac or in a backup can’t be read without that key.

The app, the background agent and outboundctl read history through Outbound. outboundctl history export pages through the background agent, so Terminal never handles the key. If Outbound finds history it can’t read, for example after the key was lost, it keeps the unreadable files under a new name, shows a notice, and starts new history beside them. outboundctl history discard-unreadable deletes those kept files for good, and outboundctl history rotate-key replaces the key; older keys stay available so kept files can still be recovered.

History recorded by an earlier version is encrypted in the background after you update.

Application Support

• ~/Library/Application Support/com.outboundfirewall.outbound/History/: recorded connection history, kept for the length you choose in Settings › Monitor under “Keep connection history” (1 day, 7 days, 30 days, or Off; the default is 7 days). Off deletes the saved history and stops recording. Deliberately not in the app group container: a directory watcher there reloads rules whenever any file changes.
• ~/Library/Application Support/com.outboundfirewall.outbound/rule-usage.json: when each rule was last used, encrypted, for the Rules pane’s sorting and the Recently Used scope.
• ~/Library/Application Support/com.outboundfirewall.outbound/Assistant/Assistant.store: Assistant transcripts. They stay on this Mac; turning history off in Settings preserves existing conversations.
• ~/Library/Application Support/Outbound/DNS/events.json: a log of changes Outbound made to the system’s DNS settings.
• ~/Library/Application Support/Outbound/Agent Workspace/: a working directory Outbound owns for the Assistant’s agent, so nothing of yours is in its reach.

Caches

• ~/Library/Caches/com.outboundfirewall.outbound/favicons/: downloaded site icons, one <domain>.icon per site, refreshed when stale. Deleting the folder is safe; Outbound downloads them again. Favicons are only fetched for a host that is already allowed.

Preferences

• Managed preferences are not stored in a file Outbound owns. They live in the managed-preference domain com.outboundfirewall.outbound, forced by your configuration profile. See Managed preferences.
• The app group suite (shared by the app and the agent through cfprefsd): the menu bar item’s choices, its style, whether it draws in colour, whether it shows today’s data, and the traffic colours. The agent reads this suite on every one-second tick, so a change shows within a second.
• The app’s own defaults (the standard domain of whichever app writes them): the global “Show Network Monitor” hotkey (the agent reads the main app’s domain for it), the map’s home location, whether you deleted the location database, whether the Network Monitor shows the map and the traffic chart, and the connection-history retention choice (the agent reads the main app’s domain for that too).

Keychain

• com.outboundfirewall.outbound.license: your licence key, with a com.outboundfirewall.outbound.license.pending-recovery entry used while a licence is being recovered.
• com.outboundfirewall.outbound.history-encryption: the key that encrypts your connection history, analytics and traffic history. Deleting it makes the saved history unreadable.
• com.outboundfirewall.outbound.ai: API keys for the Assistant’s cloud providers, one entry per provider. See Providers and what is sent.

Note

Logs of Outbound’s own operation go to the unified logging system, not to files. outboundctl debug categories prints the subsystems and a log stream command that shows them.