You’re sending us a build. Here’s what happens to it.
What leaves your machine, where it runs, who can see the result, how long we keep it — and the things we haven’t done yet. No badges; we haven’t earned any.
The threat model, in one table
| Threat | What stands in the way |
|---|---|
| Another customer reads your runs | Every query is scoped to your organisation. Someone else’s run id returns 404, not 403 — we don’t confirm it exists. |
| Your app leaves something behind for the next customer | The app is uninstalled between runs and leftover dialogs are cleared. When a device changes organisation it’s erased, because iOS keeps permission grants past an uninstall. |
| A stranger opens your evidence | Private by default. A viewer needs to be signed in to your organisation, hold an API key or OAuth token, or be a GitHub Actions job you trust. If your organisation picks repo visibility, anyone who can read the repo gets in with GitHub. Public links are opt-in, per organisation. |
| Someone guesses an evidence link | The link’s slug is random and never derived from the run id. Knowing a run id gets you nothing, and a private link needs a sign-in anyway. |
| A build URL points at a private network | Fetches are HTTPS-only. Private, loopback, link-local and CGNAT addresses are refused, checked again on every redirect, and credentials are dropped cross-origin. |
| A leaked key | Keys start sb_ so they’re easy to spot in a log or a commit. Revocation is immediate. Per-organisation caps limit what a stolen key can burn. |
| A malicious build attacks the host | Partly mitigated, and we’d rather say so. A simulator app can read what its user can read, so devices run as a separate low-privilege user behind firewall rules. See “A simulator is not a VM” below. |
| The fleet is used to reach our network | The Macs make outbound connections only. Nothing at the building they sit in accepts a connection from the internet. |
What leaves your machine
A compiled build — a zipped simulator .app or an .apk — or an HTTPS URL we fetch one from. The run request: the steps, the screenshot names, a label and any metadata you attach. That’s all.
Not your source. The hosted service can’t build from source, and a run can’t name a path on any machine. There’s no model in the hosted path either, so your build and screenshots are never sent to an AI provider.
Where it runs
The control plane is one server in the EU. It terminates TLS, holds the database, and stores builds and evidence.
The devices run on a Mac mini we own, in the UK. It dials out to the control plane over HTTPS and asks for work. Nothing connects to it. There’s no open port, no tunnel and nothing listening at the building it sits in.
That’s the whole fleet during the beta. When it grows, this page will say so.
A simulator is not a VM
Your app runs in the iOS Simulator or the Android Emulator, one run per device at a time, on a Mac that also hosts other customers’ devices. A simulator is not a sandbox from the Mac it runs on: an app inside one can read files its macOS user can read. We measured that, rather than assume it away.
So the devices run on dedicated fleet machines, under a separate low-privilege user that holds nothing else, with firewall rules limiting what that user can reach. That narrows what a malicious build can touch. It isn’t the isolation a virtual machine gives.
A virtual machine per device is on the roadmap. So are a dedicated device that is never shared between organisations, and running the devices on your own Macs with our control plane. There has been no penetration test yet.
Evidence is private by default
An evidence link opens for members of your organisation, for an API key or OAuth token, and for GitHub Actions jobs from repos you trust. Pick repo visibility and anyone who can read the repo gets in with GitHub, so reviewers don’t need a Simbase account.
Making links public is opt-in, per organisation. Once a link is public, assume anything on screen, in the steps or in the app log is visible to whoever has it. Use test accounts, not real ones.
Authenticated copies of the same files are always available through the API at /v1/runs/:id/files/:name.
How long we keep things
Evidence lasts as long as your plan says — 7 days on Free; 30, 90 or 180 days on paid plans — then the link stops working and the files are deleted.
Want everything of yours gone now — builds, runs, evidence, keys? Email hello@simbase.dev and it will be, and we’ll confirm when it is.
Keys
A key belongs to an organisation and is shown once. It has a recognisable prefix, sb_, so secret scanners and people can both spot one. Revoke it from your account and it stops working immediately.
Payments
Card details go straight to our payment processor and never reach our servers.
This website
Static HTML. No cookies, no analytics, no third-party scripts. The fonts are served from this domain.
What we haven’t done yet
- No third-party penetration test. One comes when revenue pays for it, and its summary will be published here.
- No SOC 2, and no plan for one. If you need it, we’re not the right choice yet.
- No uptime SLA. Service is best effort, and we say so rather than promise a number we can’t buy.
- One person on call. Everything is built to fail closed and credit the run, rather than to page someone.
Reporting a problem
Email hello@simbase.dev with “security” in the subject. A person reads it. Please don’t test against other customers’ data. There’s a security.txt too.