Architecture
How it works
Three layers, each of which is necessary and none of which is sufficient alone: a device the application trusts, a way to reach the flows worth testing, and a record of what crossed the network while you were there.
1. A device the application trusts
Android runs containerised on a patched host kernel. Hardware identity is applied below the layer an application can query, so it is coherent no matter which surface the integrity routine reads.
| Surface | What an app reads |
|---|---|
| sysfs / procfs / DeviceTree | Board, SoC and peripheral records consistent with the claimed handset |
| GPU | Renderer and vendor strings via glGetString, VulkandeviceName, devfreq and thermal zones |
| Cellular modem | 5G NR support, band lists and plausible signal levels |
| Sensors | Full sensor complement with per-device calibration values |
The practical test is not whether a fingerprinting library returns the expected strings. It is whether the flow you asked for renders — seethe comparison for why that is the only measure that matters.
2. Reaching the flows worth testing
You state the objective in English — register an account and attempt the payment flow. The platform then loops: read theaccessibility tree, decide which element advances the goal, interact, read the tree again to verify the outcome.
Each confirmed step is appended to a workflow. Discovery is the expensive part and happens once; the resulting workflow replays deterministically across as many devices as you need. Because steps are semantic rather than coordinate-based, they survive resolution and layout differences that break recorded scripts.
Discovery loopdump → 41 nodes, "Create account" at [0.5, 0.72]
decide → tap "Create account"
act → tap
verify → dump: registration form present ✓
commit → step 3/9 saved to workflow3. Evidence, not assertions
Every run is recorded. Network traffic is captured through a managed interception certificate, so TLS payloads are readable; screen video, screenshots and UI tree snapshots are stored alongside and timestamped against it.
This matters because a security finding is only actionable with the request that produced it and the steps that got there. A claim that an application transmits a card number in the clear is an argument; the captured request is a fact.
Scale and isolation
Independent devices
Each device carries its own identity, storage and session state. Nothing is shared between concurrent runs.
Egress by country
A residential proxy is bound per device, so geo-gated behaviour can be tested from the market it targets.
Portable placement
Hosts dial out to the control plane. Cloud region, your rack or your premises are the same thing to the platform.
Frequently asked questions
What Android version do the devices run?
AOSP 16 on arm64. Each device runs in its own container with its own storage, its own network egress and its own hardware identity profile.
Does changing Build.MODEL fool a modern application?
No. Build properties are the first thing an integrity routine reads and the easiest to falsify, so serious checks corroborate them against sysfs and procfs records, DeviceTree entries, GPU renderer strings, thermal zones, the sensor list and telephony state. Identity has to be consistent across all of them, which is why it is applied at the kernel rather than in userspace.
How does AI flow discovery avoid breaking on app updates?
Discovery and replay are separate. The model explores against the accessibility tree and emits a workflow of semantic steps — find this element, type here, verify that. Replay executes that workflow deterministically. When an update breaks a step, discovery is re-run to regenerate the workflow instead of a person repairing a script.
Where does the infrastructure run?
Device hosts open an outbound connection to the control plane rather than accepting inbound connections, so a host can sit in a cloud region, in your own rack, or on your premises without the rest of the system changing.