Security & acceptable use

Every browser runs in a single-use container that exists only for your session.

Session auto-termination

• Idle sessions (no CDP traffic) end after 5 minutes.
• Every session has a hard cap of 30 minutes.
• Sessions end immediately when your prepaid balance reaches zero.

Network controls

• Outbound SMTP is blocked (ports 25, 465, 587) on all egress, including BYOP proxies.
• Access to cloud metadata endpoints and private address ranges is blocked.

Isolation and wiping

• One container per session; no container is reused between customers or sessions.
• On termination the container, its filesystem, cookies, cache and downloads are destroyed.
• Proxy credentials passed via headers are held in memory only and discarded with the container.
• Tokens are sent in connection headers, never in URLs.

Acceptable use

You may not use CrawlFlux to:

• Send spam or bulk unsolicited messages, or create accounts in bulk.
• Access systems without authorization, bypass authentication, or test security of sites you don't own.
• Run denial-of-service traffic or deliberately overload any site.
• Commit fraud, including ad, click or payment fraud, or credential stuffing.
• Collect personal data in violation of applicable law.
• Distribute malware or host illegal content.

Respect each site's terms and rate limits. We may suspend tokens that breach these terms; unused prepaid hours on suspended accounts are refunded except in cases of fraud.

Reporting

Report abuse or security issues to security@crawlflux.dev.