New hires from Windows.
Productive on day one.

What IT gets

• An invoice in the company's name. The checkout by Polar, our merchant of record, asks for the business details and the VAT id, adds the tax that applies and issues the invoice.
• One key, many Macs. A Team key activates on up to 10 or 25 Macs. Each Mac takes a seat under its computer name; Settings → Licence → Deactivate this Mac frees a seat when a machine is retired.
• Silent activation. From a Jamf policy or an Intune shell script run as the logged-in user: /Applications/Contralto.app/Contents/MacOS/Contralto --license activate CONTRALTO-… "Finance MacBook 12". --license status prints the state; --license deactivate frees the seat.
• The managed-permissions profile below, so the one permission the app needs is granted before the person opens it.
• Priority support at the address above, with a named contact and an answer the same working day.

Managed permissions (PPPC)

Contralto needs one permission, Accessibility, and macOS lets an MDM grant it with a Privacy Preferences Policy Control payload. The profile is a signed statement about our code: it names the bundle id app.contralto.mac and the Developer ID certificate the app is signed with, so it matches every release we ship and nothing else.

The profile is published with the first signed release: it names the certificate the app is signed with, which does not exist yet.

What it contains, and what it does not:

• Accessibility: allowed for app.contralto.mac. The keyboard shortcuts, the window switcher, snapping and the clipboard panel work from the first launch; Setup shows step 1 as done.
• Screen Recording: left to the user. Apple reserves this permission for the person at the Mac; no profile can grant it. The payload uses AllowStandardUserToSetSystemService, so a standard user can switch it on for the Alt+Tab previews without an administrator. Without it the switcher shows app icons, which is fine for most teams.
• The helper: pre-approved as a managed background item (a com.apple.servicemanagement rule for our team id), so the firewall and Touch-ID-for-sudo settings never ask for a password and Login Items shows no prompt.

PPPC payloads are honoured only on Macs enrolled in MDM (user-approved enrollment or Automated Device Enrollment) and deployed at device scope. They do not install the app.

Jamf Pro

1. Computers → Content Management → Configuration Profiles → Upload → choose the .mobileconfig. Jamf shows the Privacy Preferences Policy Control and Managed Login Items payloads it contains; leave them as they are.
2. Scope it to the computers or the smart group that gets Contralto. Distribution method: Install Automatically.
3. Deploy the app with a policy (Package the .dmg's app into a .pkg with Composer or Jamf Admin, or use a script that copies it into /Applications) and, in the same policy, a script that activates the licence as the logged-in user.
4. Verify on one Mac: System Settings → Privacy & Security → Accessibility lists Contralto as on and greyed out, and Login Items & Extensions shows the helper as managed.

Microsoft Intune

1. Devices → macOS → Configuration → Create → New policy → Templates → Custom. Upload the .mobileconfig; deployment channel Device channel.
2. Assign it to the device group that gets Contralto.
3. Deploy the app as a macOS app of type DMG (Apps → macOS → Add → macOS app (DMG)) with the bundle id app.contralto.mac and the version from the download page, then a shell script (Devices → macOS → Shell scripts) that runs the activation command as the signed-in user.
4. Verify on one Mac as above.

Questions teams ask

Does the app send anything out?

No analytics, no account. The licence key is confirmed with Polar every 7 days; updates are checked against our feed once a day if allowed; app installs from the Apps screen download from the makers' servers. The privacy policy lists every request and what it carries.

Can we turn parts of it off for everyone?

Every behaviour has its own switch and the choices live in the app's preferences domain (app.contralto.mac), so a managed preference or a script can preset them; write to us for the key list. Terminals and remote desktops keep the real Ctrl by default, and the exclusion list takes any bundle id.

What happens at offboarding?

Restore every system setting puts the Mac back exactly, Deactivate this Mac frees the seat, and dragging the app to the Trash removes it. Nothing stays at the system level.