Version 1.0 · July 2026. A plain-English account of how Continuo protects your keystrokes, mouse, clipboard, and files. Every claim here can be checked against the source.
1. Why this document exists
Continuo types on your Macs and moves your cursor. Something with that much reach has to be built so you can check it rather than take our word for it. This paper sets out what Continuo does with your input and your data, what it defends against, and where it stops. The core is open source, so you can hold the claims that matter most against the code.
In one sentence: everything moves between your own Macs over mutually-authenticated TLS 1.3 on your local network, with no cloud, no account and no tracking, and every failure path gives control back rather than guessing.
2. Threat model
What Continuo protects against:
- A passive attacker sniffing your Wi-Fi (reading keystrokes/passwords in transit).
- An active man-in-the-middle trying to impersonate one of your Macs during or after pairing.
- A rogue device on your LAN attempting to connect to, or inject input into, your Macs.
- Malicious or malformed file/clipboard payloads sent over the bulk channel.
What is explicitly out of scope:
- A Mac that is already fully compromised at the OS level (Continuo trusts the endpoints it runs on).
- Physical access to an unlocked Mac.
- Traffic patterns on a hostile network. Continuo hides what you send, but not the fact that two Macs are talking.
- Anything off the local network. Continuo works on your own network only and never sends data to the internet.
3. Pairing
Devices pair using a commit-reveal Short Authentication String (SAS). Both Macs derive a short human-readable code (a set of words) from a commitment exchanged before any secret is revealed, so a man-in-the-middle cannot substitute its own key without changing the words the user sees. You confirm the words match on both screens; if they don’t, pairing fails closed.
After the first successful pairing each Mac pins the other’s identity. From then on a device presenting a different one is refused, even if it sits on the same network under the right name. Paired Macs live in a list you control: remove one and it cannot connect again.
4. Transport
Every keystroke and every mouse movement travels over one reliable channel secured with mutually-authenticated TLS 1.3, using pinned P-256 identities and forward secrecy. Mutual means both ends prove who they are. Pinned means each end accepts only the exact identity it paired with, rather than any certificate some authority is willing to vouch for. Forward secrecy means a key stolen tomorrow still cannot decrypt traffic captured today.
There is no setting that turns encryption off. Some tools in this category ship one, or shipped plaintext in the past. Continuo has never had one. Anything that can type on your Mac should not have a switch that quietly stops protecting you.
Exactly one Mac holds the input at any moment, and the one you are physically typing on always wins. That stops two machines fighting over the cursor, and it closes off a whole family of injection races. If anything goes wrong or the link drops, Continuo releases control immediately rather than holding on to it.
5. The bulk channel
Rich clipboard (images, files) and drag-across-edge file transfer ride a dedicated bulk channel that is isolated from the input path, so a large transfer can never stall or interfere with keystroke/mouse latency. The receiving side treats every incoming payload as untrusted and applies a fail-closed receive gate:
- Confined to one place. Writes are sanitised and kept inside a designated folder. Attempts to escape it are refused.
- Quarantined. Received files land in quarantine. Nothing is placed silently anywhere sensitive.
- Size-capped. Oversized payloads are refused instead of being allowed to exhaust the machine.
- Checked on arrival. Contents are SHA-256 verified, and anything that does not match is discarded.
6. What we keep
- No cloud. Continuo has no server. Your Macs talk only to each other, only on your LAN.
- No account, no sign-in. Identity is a local cryptographic keypair, not a login.
- No tracking of any kind. The app makes no outbound connection except to your paired Macs, and you can confirm that yourself against the source.
- Keystrokes never touch disk and never leave the local network.
- Redacted logs: diagnostic logs never contain keycodes or keystroke content.
7. Platform hardening
- App Sandbox. The app runs with constrained entitlements.
- Hardened Runtime. Code-injection and library-hijack protections are on.
- Notarized & signed by Apple under the developer’s Developer ID, so Gatekeeper trusts it and it hasn’t been tampered with since signing.
- Only the permissions it needs. Accessibility and Input Monitoring, which are what let it capture and inject input, plus Local Network. Nothing else is requested.
8. Verifiability
The core is open source. The security-critical parts of Continuo are published and you can read them today, without asking anyone.
The rest is available for audit, not open-licensed. The remainder of the app can be reviewed rather than freely reused. If you need to go through it for a security review, a procurement requirement or plain curiosity, ask and we will arrange access.
Pairing, the wire protocol and codecs, the mTLS transport, the control state machine and the receive gate live in readable modules you can go through. A security claim nobody can check is worth very little, so Continuo is built to be checked.
Exact primitives and parameters are documented in the source. This paper is an overview in plain English rather than a formal specification.