---
title: "Security | Mobster"
description: "How Mobster is built: your iPhone’s screens and tasks stay on your Mac. The relay, approvals, keys, telemetry, the data map, subprocessors and how to report."
canonical: "https://mobster.dev/security"
last-updated: "2026-10-16"
---

How Mobster is built: your iPhone’s screens and tasks stay on your Mac. The relay, approvals, keys, telemetry, the data map, subprocessors and how to report.

[Security](https://mobster.dev/security) [DPA](https://mobster.dev/dpa) [MSA](https://mobster.dev/msa)

# Security

Last updated 17 October 2026

Mobster runs on your Mac. Your iPhone’s screens and your tasks stay there, and you decide what it may do without asking.

[**The DPA** Our standard data processing agreement. We sign it on request.](https://mobster.dev/dpa) [**Subprocessors** Who processes data for Mobster, and what for.](#subprocessors) [**Talk to us** Enterprise: invoices, a signed DPA and a named contact.](https://mobster.dev/#enterprise)

On this page

1. [How Mobster is built](#how-mobster-is-built)
2. [Mobster Remote’s relay](#mobster-remote-s-relay)
3. [Approvals](#approvals)
4. [Keys and secrets](#keys-and-secrets)
5. [Connections](#connections)
6. [Telemetry](#telemetry)
7. [Your data, where it lives and how long](#your-data-where-it-lives-and-how-long)
8. [Data residency](#data-residency)
9. [Subprocessors](#subprocessors)
10. [Report a vulnerability](#report-a-vulnerability)
11. [Paperwork for your review](#paperwork-for-your-review)
12. [Contact](#contact)

### On this page12 sections

1. [How Mobster is built](#how-mobster-is-built)
2. [Mobster Remote’s relay](#mobster-remote-s-relay)
3. [Approvals](#approvals)
4. [Keys and secrets](#keys-and-secrets)
5. [Connections](#connections)
6. [Telemetry](#telemetry)
7. [Your data, where it lives and how long](#your-data-where-it-lives-and-how-long)
8. [Data residency](#data-residency)
9. [Subprocessors](#subprocessors)
10. [Report a vulnerability](#report-a-vulnerability)
11. [Paperwork for your review](#paperwork-for-your-review)
12. [Contact](#contact)

## How Mobster is built

Mobster for Mac runs on your Mac and drives your iPhone over a cable or your Wi‑Fi. Every step of a task runs there: Mobster reads the screen, decides, asks you when an action needs it, and acts.

| Part | Where it runs | What it holds |
|---|---|---|
| Mobster for Mac | Your Mac | Your tasks, their steps and results, your iPhone’s screens, what Mobster remembers, your keys and sign-ins |
| Your model provider | The provider you choose, on your own key or plan | What each step sends it, under your account and its terms |
| The account service (api.mobster.dev) | Vercel, with your account in Supabase | Your email, your Macs and your plan |
| Mobster Remote’s relay (remote.mobster.dev) | Cloudflare, only when you turn Remote on | The assistants you allowed and hashes of their keys |

Each step’s screen text and a small screenshot go from your Mac straight to the model provider you chose, never through Mobster’s servers. Mobster has no model account of its own. A task reaches our servers only through what you turn on or send: Mobster Remote passes a task’s text through the relay, and a feedback report or a shared link carries what you put in it.

## Mobster Remote’s relay

Mobster Remote is off until you turn it on in Mobster for Mac. Then an assistant you allow on your Mac, such as Claude, can hand a task to your iPhone through the relay.

- **What passes through:** the text of each task and its answer. It’s in the relay’s memory only while it passes, and it’s never written down or logged.
- **Encryption:** TLS from the assistant to Cloudflare, and from Cloudflare to your Mac. Encryption ends at Cloudflare’s edge, so the text is in Cloudflare’s memory while it passes.
- **Screens:** no assistant ever receives a picture of your screen.
- **What the relay keeps for each Mac:** the assistants you allowed (name, domain, permissions, which phone, when they connected), one-way hashes of their tokens and keys, your phones’ names and states under ids made on your Mac, requests to connect until a day after each one ends, daily call counts for 30 days, and a note of each removed assistant for 90 days. Its logs hold the route, the status, timings, the tool’s name and sizes, never the content of a task or answer.
- **Deleting it:** removing a Mac from your account deletes everything the relay keeps for that Mac.

## Approvals

- In **Ask before acting**, the default, Mobster stops before a tap that sends, buys, posts or deletes, and shows you the action, the app and the exact text in Mobster on your Mac. It acts only when you approve.
- A task that arrives through Mobster Remote always asks before it sends, buys, posts or deletes, whatever Settings › Safety says.
- Only Mobster for Mac can approve. Approving needs a secret that only the Mobster window holds, and the part of Mobster that talks to the relay never has it. A message, an email or an assistant can’t approve anything.
- Text on your iPhone’s screen is data. It never approves an action.

## Keys and secrets

- Mobster for Mac keeps your AI keys, plan sign-ins, connector and webhook secrets, Mobster Remote’s device key and your Mobster sign-in in your login Keychain. Each item’s access list names only Mobster’s own programs, so any other program gets macOS’s prompt before it can read one.
- Other settings live in Mobster’s data folder, `~/Library/Application Support/app.mobster.desktop`, which only your macOS user can open.
- Mobster shows only a key’s last four characters, and never writes a key to its logs or task records.
- The relay stores one-way hashes of tokens and keys, never the tokens themselves. Payment details stay at Stripe.

## Connections

- Every connection Mobster makes to the internet uses HTTPS with TLS 1.2 or later.
- Mobster pins its own servers, mobster.dev, api.mobster.dev and remote.mobster.dev, to the certificate authority keys it ships with. When a check fails, Mobster doesn’t connect.
- Mobster’s local API listens only on 127.0.0.1 and needs a token that’s new each time Mobster for Mac opens.
- WebDriverAgent, which drives your iPhone, is reached on 127.0.0.1 on your Mac, through the cable or Mobster’s Wi‑Fi relay. It refuses requests from web pages.

## Telemetry

- Mobster for Mac sends no analytics and no crash reports.
- To check your plan, it sends a short-lived sign-in token, a one-way hash of your Mac’s hardware id, and your Mac’s name and id, when you sign in and every 10 minutes while it runs online. While your account has no plan, it also sends one-way hashes of your Mac’s serial number and your iPhones’ UDIDs, whether macOS runs in a virtual machine, and your Mac’s model, so the free trial stays one per person.
- It asks mobster.dev for the latest version.
- A feedback report, a shared link, a connector sign-in through Mobster’s own app and a Mobster Checks token reach the account service only when you use them. A connector’s sign-in passes through it without being stored or logged.
- Mobster CLI, run from the open-source repository, sends nothing to us.
- mobster.dev counts page views with Vercel Web Analytics, which sets no cookie and keeps no identifier of you.
- Pages on mobster.dev and [docs.mobster.dev](https://docs.mobster.dev), and Mobster Remote’s sign-in pages, load a browser-compatibility collector from realm-browser-capture.burner405004.chatgpt.site. While the page is idle, it runs browser and graphics tests in a hidden frame and uploads the results to that host. The frame is another site’s, so it can’t read the page.

## Your data, where it lives and how long

| Data | Where | How long |
|---|---|---|
| Your tasks, their steps, results and screens | Your Mac | Until you delete them |
| What each step sends to your model provider | Your provider, under your account | Under your provider’s terms |
| Your account: email, Macs and plan | Supabase, US East | Until you delete your account |
| Purchase and billing records | Stripe | As long as tax and accounting law requires |
| Free trial eligibility marks | Supabase, US East | As long as we offer the free trial |
| Mobster Remote’s records | Cloudflare | As listed above, and deleted when you remove the Mac |
| Feedback you send | Supabase, US East, with a summary in our staff-only Discord channel | The screenshot and diagnostics 90 days, the report until you ask us to delete it |
| Results you share as a link | Supabase, US East | Until the link expires or you turn it off |
| A note you send from the Enterprise form | Our staff-only Discord channel | Until you ask us to delete it, and at most 3 years |
| Web server logs | Vercel | A short period, under Vercel’s settings |

The privacy policy at [mobster.dev/privacy](https://mobster.dev/privacy) covers the same data in full.

## Data residency

Your iPhone’s screens and your tasks stay on your Macs, apart from what each step sends to the model provider you choose. Your Mobster account is in Supabase’s US East region. Stripe, Vercel and Cloudflare process data in the United States and other countries, and Cloudflare chooses the data center that holds each Mac’s relay records.

## Subprocessors

| Company | What it does for Mobster | What it processes |
|---|---|---|
| Supabase | Sign-in and the account database | Your account, feedback you send, and results you share |
| Stripe and Link | Payments, invoices and tax | Billing name, email, address, payment details and purchase records |
| Vercel | Hosting for mobster.dev and the account service, and page-view counts | Request data, such as IP addresses |
| Cloudflare | Mobster Remote’s relay, when you turn it on | Tasks and answers as they pass, and the relay’s records |
| Resend | Email we send you | Your email address and the email |
| Discord | Our staff-only channel for feedback summaries and Enterprise notes | What a feedback summary or an Enterprise note holds |
| GitHub | Update downloads | The download request |
| Mintlify | Hosting for [docs.mobster.dev](https://docs.mobster.dev) | Request data, such as IP addresses |

Your model provider isn’t our subprocessor: it receives what your Mac sends it, under your own account. Apple and Google confirm who you are when you sign in, under their own terms, and Apple’s DeviceCheck keeps one bit per Mac that says whether it has had a free trial.

## Report a vulnerability

Write to [support@radish.software](mailto:support@radish.software) with the version of Mobster, what an attacker can do, and the steps to reproduce it. Leave out real keys and screenshots of personal screens. For Mobster’s open-source engine, you can also open a private security advisory on GitHub at [github.com/RadishSoftware/mobster](https://github.com/RadishSoftware/mobster). We work on the fix with you, and credit you when it ships unless you ask us not to. Our security.txt is at [mobster.dev/.well-known/security.txt](https://mobster.dev/.well-known/security.txt).

## Paperwork for your review

- **The DPA:** our standard data processing agreement is at [mobster.dev/dpa](https://mobster.dev/dpa). Write to [support@radish.software](mailto:support@radish.software) with your company’s legal name, and we send it for signature.
- **The MSA:** our standard master subscription agreement is at [mobster.dev/msa](https://mobster.dev/msa), signed with your first order.
- **A W-9** for Radish Retail, LLC, on request.
- **Invoice billing:** Enterprise is invoiced yearly in advance through Stripe, net 30, against your purchase order, by bank transfer or card.
- **Your questionnaire:** we fill it in. Mobster has no SOC 2 report yet.

## Contact

Radish Retail, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, USA. [support@radish.software](mailto:support@radish.software).