cdpfleet / Security
Isolation and privacy
Your browsers reach the web, and nothing else.
Every session is its own browser with its own limits, it can reach only the public internet, and what it leaves behind — videos, files, saved logins — is yours alone, behind keys and short-lived links.
- 0private addresses reachable
- 15 minprivate links to videos and files
- headerAPI keys for the account API
Each session on its own
- A fresh browser every time: a session starts without cookies or storage from anyone, including your own earlier sessions, unless you restore one of your persistent profiles.
- Its own limits: each session has its own memory ceiling and tab cap. A session that runs out of memory ends alone (
session_memory_limit); your other sessions, and other customers' sessions, carry on (limits). - Nothing left behind by default: when a session ends its browser data is gone. A video is kept only as your recording settings say, and downloaded files only if you launched with
"downloads": true.
Only the public internet
- Private and internal addresses are refused: loopback, private ranges (10/8, 172.16/12, 192.168/16), CGNAT, link-local and cloud-metadata addresses and the servers' own addresses — for pages, redirects,
context.request, and DNS names that resolve to them. On 2026-11-01 a request to the cloud-metadata address failed from Chromium, Firefox and WebKit sessions alike. file:URLs are refused in sessions: opening one fails with "file: URLs are not allowed in sessions" — measured on Chromium, Firefox and WebKit on 2026-11-01.- The same rule for everything you hand us: a
proxy, astart_urlor a VPN endpoint that points to a private or local address is refused at launch with400(errors).
What the sites you visit see
- Your exit, not our servers: a session's traffic leaves through the proxy or VPN you choose (or the included Community proxy), so sites see that exit's address. Our daily tests check that a session's exit is never the address of the server it runs on.
- WebRTC too: behind a proxy no browser exposed the server's own address over WebRTC; Camoufox reports the proxy's exit (case 54).
- You connect to cdpfleet, not to a server: your code connects to the launch API and the session URL it returns on cdpfleet's own hostnames.
Keys, links and stored secrets
- API keys in a header: the account API takes keys only in the
x-api-keyheader, because keys in URLs end up in logs, browser history and Referer headers. Connect URLs also accept?api_key=for tools that can't send headers — keep those URLs private. - Keys you control: a key is shown once, when you create it, and can be revoked at once; a temporary key from the code generator stops working after an hour; AI assistants connected with OAuth can be disconnected in the dashboard (dashboard).
- Private, short-lived links: recordings and kept downloads are served through cdpfleet.com links that expire after 15 minutes and are only issued to the owner. Downloaded files are always served as attachments, so they never open on cdpfleet.com.
- Secrets stay secret: saved proxy passwords are masked in the API, saved VPN configs are stored encrypted, and payment cards are handled by Stripe, never by us.
Your data
- Paid plans are private. Request data from free Community sessions may be used to learn which browser setups work on which sites, so don't sign in to accounts or handle personal data on Community (Terms, section 4A).
- Retention you can see: recordings 7–30 days by your settings, kept downloads 2 days, session history 30 days in the dashboard; delete recordings and files sooner yourself. The details are in the Privacy Policy.