Security

How Captain Relay is designed to control remote access safely.

Operated by ZEBRABYTE LIMITED · Registered in England and Wales · Company 15194067 · Registered office: Suite 7165a, 60 Tottenham Court Road, Fitzrovia, London, United Kingdom, W1T 2EW · Last updated: 23 September 2026

Security model

Authenticated access before private remote operations.
Server-side device ownership and tenant scoping.
Exact remote-tool discovery before execution.
Server-enforced allow, deny and human-approval policies.
Persistent jobs with attributable status/results.
Device/session revocation and audit records.
Fail-closed host routing between app, API, MCP and installer surfaces.

Payment security

Payment credentials are intended to be collected through secure payment-provider components rather than stored by Captain Relay application servers.

Vulnerability disclosure

Email cybercrime@zebrabyte.co.uk with the affected component, reproduction steps and impact. Do not access other customers' data, persist on systems or degrade availability.