SECURITY

Security for cloud browser sessions.

A public overview of the security boundaries and operating practices teams should understand before using Remote Browser in production.

Open Console Read docs

Session isolation

Each Remote Browser session runs as a separate cloud Chromium runtime with its own lifecycle. Sessions are created through authenticated API calls and should be terminated after the workflow finishes or by idle timeout.

Use a dedicated API key per environment or agent.
Terminate long-running browsers when a workflow is complete.
Keep sensitive automation in workspaces and profiles you control.

Profiles and recordings

Profiles can preserve cookies, browser storage, and browsing context across runs. Recordings and live viewers help with debugging but may expose sensitive on-screen data, so teams should treat access to them like production telemetry.

Do not share profile-backed browser links publicly.
Limit viewer access to people who need to debug a run.
Use short retention windows for recordings that contain sensitive workflows.

Responsible automation

Remote Browser is intended for legitimate automation, QA, research, monitoring, and owned-account workflows. Customers are responsible for complying with site rules, account terms, privacy requirements, and applicable laws.

Respect rate limits and robots or API policies where they apply.
Avoid collecting data you do not have rights to process.
Use proxy egress only for approved regional routing and reliability needs.