Help

A configuration describes one kind of task: where the worker starts, which websites they may reach, and what the device is allowed to do. Sessions are created from a configuration, and each session keeps the exact version it was created from — editing a configuration later never changes a session already running.

Saving publishes a new version. Old versions stay, because sessions and audit history refer to them.

Name is optional. Leave it blank and Relay names it for you.

Every configuration has exactly one starting website — the page that opens when the worker begins — and any number of additional allowed websites. Additional websites need no address of their own to start from; they only widen where the task may go once it is running.

Example. Start at telegram.org and add sumsub.com as an additional website. The worker opens Telegram. If Telegram sends them to Sumsub to verify their identity, Relay allows it. If a website sends them anywhere else, Relay blocks it and tells the worker.

Each website has an access boundary:

• Entire domain — the website and its subdomains. Choosing telegram.org also allows www.telegram.org.
• Specific section — one address and the pages beneath it, on the same website. https://example.com/account allows /account/settings but not /admin.
• Open web navigation — the worker can follow links and redirects to any secure website. Use it when a task passes through providers you cannot list in advance. This is a decision about the whole task, so only the starting website offers it.

A starting website set to Specific section may list several sections of itself — /account, /verify and /documents, for example. The task still opens at exactly one address, the one above the boundary; the other sections only widen where the worker may go, and every one of them has to be on the same website.

Open web navigation is broad, but it is still Relay. Downloads, other apps, other browsers, and insecure addresses stay blocked under every boundary.

Creating a session produces a one-time code. Give it to one worker; it works once.

• Created · Waiting for worker — nobody has used the code. Nothing is counting down yet.
• Revoke code — cancels a code nobody has used. Available only before it is redeemed.
• Active — a worker is holding the task and its expiry is counting down.
• Terminate — ends a task a worker is holding and requires their device to clean up. Available only while it is running.
• Expired — the time ran out.
• Cleanup pending — the task ended, but the worker's device has not yet confirmed it removed the browsing data. See troubleshooting below.
• Delete — removes a finished session from your list. Its completion proof and audit history are kept.

Task name is optional; leave it blank and Relay names the session for you.

The clock starts when the worker redeems the code, not when you create the session. A five-minute session handed out in the morning and redeemed after lunch still gives the worker their full five minutes.

Choose a preset from five minutes upward, or enter a custom duration in minutes or hours. The maximum is twelve hours. The server decides the exact expiry time — a worker's device clock cannot extend or shorten a session.

Camera is Off, Allow when requested (the worker can approve a request from an allowed page) or Required (the task expects a capture step). A page can only ask for the camera if the worker is allowed to be on it, and Android still asks for its own permission.

Screenshots can be blocked while the task is on screen. Clipboard can be restricted. Both are best-effort on Android and cannot defeat a compromised device.

You can change any of these for a single session when you create it, without editing the configuration.

Sign-in uses your admin ID and a time-based code from your authenticator app. Sessions you create belong to your admin account.

Sign-in duration sets how long a new admin browser session stays signed in. It is a fixed deadline stamped on each sign-in by the server, so nothing you do in the browser extends it, and changing the setting applies to your next sign-in rather than the one you are using. Separately, a browser left unused is signed out after 30 minutes; that window is not adjustable. Sign out everywhere ends every session immediately whatever duration they were given.

Archive a configuration to stop it being used for new sessions while keeping it in your list; archiving can be undone. Delete takes it out of your list for good. Neither one affects a session that already exists: a session carries its own copy of the rules it was created from, so it keeps running, keeps its completion code, and still names the configuration it came from.

The worker sees “Page outside this task”. A website tried to send them somewhere the configuration does not allow. Add that website as an additional allowed website, or choose a wider boundary.

The worker sees “This page is taking longer than expected”. The page stopped responding. Relay keeps the task alive and offers a retry; a slow page that is still loading is never interrupted.

The worker sees “Update required”. Their installed version of Relay is no longer supported. Send them the current APK; there is nothing to fix on this side.

A finished session will not delete. Its worker has not confirmed that the device removed the browsing data — usually because the app was force-stopped or the phone went offline for good. Relay will not pretend the cleanup happened. Once the worker has been unreachable long enough, the session offers Record as abandoned, which notes that cleanup was never confirmed and lets you delete the row. If that device ever comes back, it still performs the cleanup.