Skip to the content

Security at Trailcam

Trailcam runs your builds, keeps your flows and records every run. Here's how we keep all of it safe, and how to tell us if you find a problem.

Start freeReport a problem

  1. A clean device for every run

    Your builds run on simulators and emulators that start clean and are thrown away.

    • On iOS, each run gets a new clone of a clean simulator; on Android, an emulator started read-only from a clean snapshot. Each is discarded when the run ends, so nothing one run does carries over to the next.
    • The machines that host devices connect out to Trailcam over an encrypted connection, and take no connections in.
    • Each host has its own key, stored only as a hash. Revoking it disconnects the host at once.

  2. Your workspace, walled off

    Another workspace can't see yours: the database itself won't show it.

    • Every table holding a workspace's data has a Postgres row-level security policy, and the app's database role can't get round it.
    • Each part of the API is tested to answer as if another workspace's data didn't exist.
    • Owners, Admins, Members and Viewers can each do what their role allows, and every change is checked on our servers, not only hidden in the app.
    • On every plan, Owners and Admins can see who changed what and when, and download it. The audit log's entries can't be edited.

  3. Signing in, without passwords

    There's no password to steal, guess or reuse.

    • Sign in with a code by email, Google, GitHub or a passkey.
    • Changing an email, adding a passkey, connecting Google or GitHub, making someone an Owner, or deleting an account or a workspace needs a sign-in from the last day.
    • Your session lives in a cookie that scripts can't read and that's only sent over HTTPS. Trailcam's API trusts only tokens that last two minutes.
    • We don't keep Google's or GitHub's sign-in tokens.

  4. Secrets stay secret

    What could let someone in is encrypted, or kept only as a hash we can check but not read.

    • Everything travels over HTTPS, and browsers are told to use nothing else (HSTS).
    • Slack and webhook addresses, PagerDuty keys and webhook signing secrets are encrypted with AES-256-GCM, and never shown again or exported.
    • CI keys, sign-in codes and shared run links are stored only as hashes.
    • Webhooks Trailcam sends are signed, following Standard Webhooks; webhooks from GitHub and Stripe are checked.
    • Everything else is encrypted at rest by the services that store it.

  5. Kept as long as you need, gone when you say

    Recordings are kept for your plan's time, and nothing outlives a deleted workspace.

    • Recordings, screenshots and logs are kept 7 days on Free, 30 on Starter, 90 on Team and 180 on Business, then deleted. Run results stay.
    • Deleting a workspace erases its data at once, and its files straight after.
    • Owners can download everything in the workspace as one file: its people, projects, flows, checks, runs and audit log. Anyone can download their own data.
    • Shared run links are random, last 1, 7 or 30 days, and can be turned off at any time.

  6. Trailcam AI, on your terms

    What it reads, where it runs, and how to turn it off.

    • It reads the structure of the screen where a run failed, the step and its error. Visual checks also read the last screenshot of a passing run.
    • Describe it and Find my journeys use Anthropic's Claude, through Cloudflare's AI Gateway; the rest runs on open models hosted by Cloudflare Workers AI. Your data isn't used to train any model.
    • Your flow's variables reach it only by name, and what a flow types is left out of what it reads. Password fields, and the details you give Describe it, are hidden from it too.
    • It's on by default, and an Owner can turn it off for the workspace.

  7. The app and this site

    Locked down in the browser, and limited at the door.

    • A strict Content Security Policy: no third-party scripts, apart from Cloudflare Turnstile, which only the sign-in page loads.
    • Other sites can't show Trailcam in a frame.
    • Sign-in codes, uploads, runs and shared links are rate-limited.

  8. Where it runs

    A few well-known services, each listed with what it does for us.

    • Trailcam runs on Cloudflare: the app, its files, email and Trailcam AI. Its database is Postgres at PlanetScale, and payments are Stripe's.
    • Your data and the devices your runs use are in the US.
    • Every service that handles customer data is on the sub-processors page.

Found a problem? Tell us

If you think you've found a security problem in Trailcam, email security@trailcam.dev with what you found and how to see it. Please give us time to fix it before telling anyone else.

More of Trailcam

Find out before your customers do

Start with the journey that would hurt most if it broke, usually sign-up or checkout. One reliable check beats ten flaky ones.

Start freeSee pricing