Deploying Altypist across a fleet

1. The app

Distributed as a notarised DMG containing Altypist.app. Repackage it as a .pkg for your MDM if that is your workflow, or deploy the app bundle directly to /Applications. It is signed with our Developer ID and stapled, so Gatekeeper is satisfied without an exception.

Requirement	Value
macOS	15 or later
Architecture	Apple Silicon only (M1 or newer)
Bundle identifier	tech.loqui.app
Disk, app	modest; the model is the bulk — see step 4

2. Push the licence key

Altypist reads a managed preference, so you never type a key on a user's machine. Deliver a configuration profile for the tech.loqui.app domain setting licenseKey to the key we issue you. On first launch each Mac activates itself against our licence server and consumes one seat.

Activation sends only the licence key and a SHA-256 hash of the Mac's hardware identifier. It does not send a username, a serial number, or anything about the machine's contents.

3. Permissions

Altypist needs two, and they behave differently under MDM:

• Accessibility — how the finished text is typed into the field the cursor is in. This can be pre-approved with a Privacy Preferences Policy Control (PPPC) profile granting Accessibility to tech.loqui.app, so nobody sees a permission prompt.
• Microphone — Apple restricts pre-approval of microphone access, so plan on the user granting this once, at first launch. Altypist asks for it during onboarding and explains why. Worth a line in your rollout note so it is expected.

Without Accessibility, Altypist falls back to the clipboard rather than failing, but the experience is worse; grant it if you can.

4. The recognition model

The model is not bundled with the installer — each Mac downloads it once from Hugging Face on first launch, then works offline. Sizes depend on which model you standardise on:

Model	Download	Choose it when
Altypist Small	~600 MB	Bandwidth matters and dictation is short
Altypist Medium	~1.6 GB	Default; the balanced choice
Altypist Large	~3 GB	Longest dictation, unfamiliar names, accents

For a large rollout on a metered link, stage it: deploy to a pilot group first, or schedule first launches rather than having sixty Macs pull the model simultaneously. If pre-seeding the model into your image would help, write to us — it is a directory copy and we will document the path for your case.

5. Seats, moves and leavers

A seat is occupied by a Mac. A user can free their own seat from Settings → Licensing → Unlink this device before handing the machine back. If a Mac was wiped without unlinking, write to us with the licence key and we will free the seat. We can also tell you how many seats are in use.

There is deliberately no admin console: the app holds no accounts, so there is no identity for a console to show. That is the same design decision that means there is nothing to deprovision when someone leaves.

6. What to tell your users

Two sentences usually suffice: press the shortcut, speak, and the text appears where the cursor is; nothing is uploaded, so it works on a plane. The default shortcut is ⌃⇧Space and can be changed per user, or standardised by policy if you prefer consistency.

7. Verifying our claims before rollout

• Put Altypist on one Mac, complete onboarding, then disconnect the network entirely and dictate. It keeps working.
• Watch it with Little Snitch or a proxy: after the model download you will see licence validation and an update check, nothing else.
• codesign -dv --verbose=4 /Applications/Altypist.app and spctl -a -vvv -t exec /Applications/Altypist.app confirm the Developer ID and the notarisation.