Security

Access and sharing

Opening a PR preview without a share link requires sign-in and repository authorization. The person who installed the GitHub App is allowed; everyone else is checked for repository permission, and access decisions are cached for up to five minutes.

Share links are bearer credentials. Anyone with a valid link can control the shared device without signing in, and can restart or relaunch it within the link's limits. A PR preview's link never grants more than its creator can still do: every use re-checks the creator's current repository access. The credential stays in the URL fragment. Revoke a link when it should no longer grant access.

Viewer connections authenticate with short-lived, single-use session tokens sent over the encrypted connection, never in its URL.

Isolation and credentials

Source builds run in isolated Firecracker build guests. Sessions run on the Android Emulator on Linux/KVM, and each new session gets a clean device. Everyone using the same share link reaches the same device.

To clone a repository, the coordinator obtains short-lived GitHub installation credentials scoped to that repository. Build guests run repository code without those credentials. Fleet agents have no database access and no standing GitHub credentials.

Ramus processes uploaded apps, build output, and device streams to provide the service. Assume anyone with a device's share link can see data entered into it, and keep secrets out of build output and screenshots.

Camera and microphone

A session owner and anyone with its share link can feed their own camera and microphone to the device; homepage demos and trial sessions cannot. Only one viewer feeds them live at a time, and the other viewers see that person's name. Anyone viewing the session sees the device's screen, including an app's camera view.

Live video and audio reach the device through the fleet host's memory and are never recorded or stored by Ramus. Image and audio files sent as camera or microphone sources are held in memory for the session only. Product-analytics session replay pauses for every viewer while any viewer's camera is live and never captures the camera preview. See Camera and microphone.

Retention

Ending a session discards its device state. Closing or merging a PR expires its previews and ends their sessions; it does not immediately delete stored objects.

Your dashboard shows a small, low-resolution picture of each session's screen, taken about once a minute while the screen changes and once when the session ends. Only the session's owner can see it; share links and previews never show it. No picture is taken while a camera is live on the session. Each picture is deleted 7 days after its session ends.

Built APKs, uploaded APKs, and stored build logs have a configured 30-day storage expiry. Storage expiry is separate from preview or share-link availability, and it does not guarantee immediate deletion. Contact us with questions about account data or operational log retention.

For security questions or reports, contact [email protected].