Questions buyers ask

So your bill never runs on a clock. Hourly billing charges you for every hour a browser is up: 3 profiles in use 8 hours a day is about 720 browser-hours a month. Here the hours you use are not billed; you move up a plan when you need more profiles at once, never because a meter ran out.

They start from a different browser. Those services run Chrome's engine and patch what it reports so it claims to be an iPhone. Underneath, it is still Chrome's engine. Driftstack starts from Safari's engine instead. Nothing is patched over Chrome. How it works.

In the Stripe Customer Portal. It is linked from your Driftstack dashboard and from every Stripe receipt email. Payment-method updates, invoice downloads, subscription cancellations, and tax-ID configuration all live there.

No. Card details are stored by Stripe, never by Driftstack. We hold a Stripe customer ID and the facts about your subscription; the card number itself never touches our servers.

Yes. You can pay with crypto from your dashboard; each crypto payment covers one month of the plan you choose. Card payment through Stripe works on every plan you can buy from your dashboard, and Enterprise pays as set in its contract. Crypto payments are non-refundable, except in the few cases the refund policy lists (such as a payment for a plan we could not deliver): a crypto term does not renew on its own, and the term already paid is not refunded (see refund policy).

An assistant that drives a session for you. Describe the task in plain English and watch it run step by step. It stops for your OK when a step looks like a purchase, a payment or an account deletion. Approve or deny that step. The AI agent is on every paid plan. Starter to Scale include AI credits each month, and you can add your own AI key instead. The free trial does not include the AI agent. To use your own key, add it on the Settings page of the web dashboard; your AI provider bills you directly for what the agent uses on it.

The AI agent splits your task into steps from a fixed set: open a page, tap, type, wait, capture. The AI cannot invent new ones. It runs them while you watch, with a live transcript and screenshots. In pair mode, you can take over and hand back at any time. Full reference.

Add your own AI key on the Settings page of the web dashboard (/settings). Agent sessions then use it as you choose there: always, never, or automatically (the default), which uses your plan's credits first and your key when the credits cannot pay. A saved key is used for 90 days; save it again to renew it. (For developers: you can also send it with each message; Who pays for the AI shows how.) Your AI provider bills you directly for what the agent uses.

Yes. It is stored encrypted, used only on our servers (when the agent runs, or when the key is checked), never logged and never shown back to anyone.

Mostly in the EU today, and not only there. Your account data lives on our EU servers. Sessions run on Macs in data centres in the US and the Netherlands. Stored files, like avatars and each profile's encrypted browser data, use a storage network that can copy them outside the EU. Files you add to a session stay on its Mac and are deleted when it ends. The optional AI agent sends what it needs to its provider in the US. We do not promise EU-only storage or processing. Our providers and their locations.

No. Account data is stored in the EU (Germany) today; sessions run on Macs in the US or the Netherlands.

Your sessions, profiles and logs, and which plan you are on. Never your card, password or two-factor recovery codes. Invite teammates by email from the desktop app's Team view or the dashboard's Team page. A member can view; an admin can also create, change and delete. The audit log shows who did what, and its newest 10,000 entries can be exported as CSV or JSON. Your sign-in IP addresses and browsers stay private to you. Teammates never see them. How a teammate's program acts on your account: docs.driftstack.io/reference/team-workspaces.

Yes. The web dashboard supports time-based one-time passwords (TOTP — the six-digit codes from an authenticator app) plus single-use recovery codes. Once enrolled, dashboard sign-in asks for a code as well as your password. You can also see every active dashboard session and revoke any of them. Team members never see your recovery codes. Set it up under Settings in the Driftstack dashboard.

We follow the GDPR: the Privacy Policy, the data processing agreement (DPA) and the Acceptable Use Policy are linked in the footer of every page; the list of companies we rely on is in DPA Annex 3; requests to have your data deleted (GDPR's "right to erasure") are answered within one month (two more months where the law allows it for complex requests); billing records are kept 7 years under Dutch tax law. The Terms of Service, Privacy Policy, DPA and Acceptable Use Policy are in force.

No. Driftstack is not currently SOC 2 or ISO 27001 certified. The current compliance basis is GDPR, plus the EU's standard contractual clauses (SCCs) and the EU-US Data Privacy Framework (DPF) for data leaving the EU. If your policy requires certified infrastructure, self-hosting on hardware inside your audited environment is the available option.

In the footer of every page — the four documents live at /legal/*. We record which version of each document you accepted, with its exact wording; API keys can be created only once the current versions are accepted. A small correction that changes no one's obligations keeps your earlier acceptance.

Neither. Each one runs WebKit, the engine inside Safari, on Macs in a data centre, so what a page measures in the browser comes from that engine. Choose from 16 live-updated iPhone profiles, built from WebKit, Safari's engine. We compare what websites can measure against real iPhones. Any difference counts as a bug in the engine. See what we check.

Not directly, and by design. Those tools attach through a remote-control connection, and Driftstack offers none. Instead, drive sessions from our SDKs for TypeScript, Python and Go with simple actions: navigate, interact (tap, type, scroll, press), wait, capture, extract, state, search and login. Start with the TypeScript, Python or Go quickstart.

On Macs in the US, hosted by MacStadium, or in the Netherlands, hosted by Green Mini host. Where your account data lives.

16 device profiles. 7 iPhone models, from the iPhone 13 to the 15 Plus, in Safari 26.4–26.6.1. A device profile is one specific iPhone model with its iOS and Safari versions. Every profile you create is built on one. New profiles get a randomly chosen iPhone model from those your plan includes that are open for new profiles; you can also pick a model yourself. Every paid plan offers all of them; the free trial offers the iPhone 13. There are no iPad, Android, or desktop profiles. Not every iPhone in that span is included; GET /v1/archetypes lists each model and whether it is open for new profiles. (For developers: GET /v1/archetypes returns the current list, no sign-in needed.)

In the desktop app, yes. Start a recording on a session you are driving, stop it, and replay it from the Recordings view, or save it as a video file. Recordings are saved on your own computer and never leave it — Driftstack keeps no server-side copy. Sessions driven from code take screenshots on request instead: a capture step in an agent session (POST /v1/agent-sessions/:id/steps). Details on /docs/recordings.

It moves to a recycle bin: hidden from your list, restorable for at least 7 days, then purged for good. A profile in the recycle bin does not count toward your plan's profile limit. Restoring one needs a free slot on your plan, and each plan allows a set number of restores in any 30 days. From the API you can also take a snapshot of a profile's settings and restore it into a new profile later (snapshots do not include cookies or logins), export a profile's settings as a file and import them again, and read a per-profile activity feed. Every profile change lands in your audit log, which you can export as CSV or JSON at any time. Details on /docs/profiles.

Yes — three ways, each with access you can limit and revoke. API keys are the usual path for your own code. Other apps connect through a standard sign-in, so they never see your password, and you can revoke them one at a time — see /docs/oauth-apps. Command-line tools show a short code you approve in the dashboard. Every sign-in and key action is recorded in your audit log.

Plan to reshape your scripts, not swap a URL. Scripts built for them can't connect directly, so you rewrite each one as Driftstack actions. Anything tied to Chrome, like Chrome-only commands or page-styling quirks, needs changing. Step-by-step guides: from Browserless, from Puppeteer. Want a hand? Email [email protected] before you switch.

Yes. That is what the 7-day trial is for, and no card is needed to start it. Run sessions through Driftstack alongside your current vendor and compare the results on your own flows. Some teams subscribe after watching how their flows behave; some find their current setup already does what they need and stay where they are. Either outcome is fine: we would rather you make the right call.

Legitimate automation, yes. Fraud, attacks, and bots against vendors that ban them, no — and scraping only within a site's own terms. Use it for testing, research, agency work and AI agents. Never for attacks, fraud, fake accounts, breaking into logins or past rate limits, or illegal content. Abuse leads to a review under our Acceptable Use Policy; repeat abuse closes the account.

Two protections. Data portability: Export your audit log as CSV or JSON, and each profile's settings as JSON through the API, any time. Self-hosted option: Self-Hosted Enterprise contracts include source escrow, set up with your contract. How self-hosting works.

Email [email protected]. What comes with each plan: Starter, Email, 48-hour reply target; Pro, Email, 48-hour reply target; Team, Priority email; Scale, Priority email and, on request, a shared channel; Enterprise, A named contact and an uptime commitment. A reply target is an operational goal, not a contract; Enterprise's service level is in its contract. You can also write to us from Help in the app or the dashboard. Conversations started by email continue by email and are not listed in Help.

You get a clear, machine-readable error, and you keep everything you captured. Screenshots, page snapshots and PDFs reach you the moment you take them. Your slot frees the moment we detect the failure. See what the session did in the desktop app or the API.

It depends on your plan. The self-serve plans (Starter, Pro, Team and Scale) have no contractually binding uptime commitment: we run best-effort, and operationally we aim for 99.5% or better, but we do not promise a percentage we could not stand behind. Enterprise carries the uptime commitment set out in its contract, and the one plan no longer sold that had a service level keeps it for the period Terms section 8.13 sets for it: until you change plan or for twelve months from the first paid subscription to API Scale on your account, whichever comes first. Either way, the status page publishes incidents with timestamps and a written root-cause analysis (RCA) for each. If an incident hurts your work meaningfully on any plan, email [email protected] with concrete impact and we may offer a credit at our discretion. Where a plan kept under Terms section 8.13 carries a service level, its credits are in the credit table of the SLA policy.