Marathon Cloud is designed with security and data isolation as core principles.
Data retention
Section titled “Data retention”Marathon Cloud stores data only for the duration required for test execution and result retrieval:
- Application binaries: Stored for 7 days.
- Test results and artifacts: Stored for 30 days.
After these retention periods, all data is permanently deleted from our systems.
Network and authentication
Section titled “Network and authentication”API authentication
Section titled “API authentication”All interactions with the Marathon Cloud API require an API key. Pass the key using the --api-key flag or the MARATHON_CLOUD_API_KEY environment variable. API keys are scoped to your organization.
Encryption
Section titled “Encryption”The CLI communicates with the Marathon Cloud API (cloud.marathonlabs.io) exclusively over HTTPS. All data in transit is encrypted.
IP allowlisting
Section titled “IP allowlisting”Organizations with strict security requirements can configure IP allowlisting to restrict API access to specific network ranges. Contact support to enable this feature.
Device isolation
Section titled “Device isolation”Marathon Cloud ensures complete isolation between test runs:
- Fresh provisioning: Every test run uses freshly provisioned virtual devices.
- No persistence: Devices are destroyed immediately after the run completes.
- Zero state leakage: No data or state persists between runs from different users or organizations.
Compliance and SSO
Section titled “Compliance and SSO”Certifications
Section titled “Certifications”Marathon Cloud does not hold SOC2 or similar compliance certifications at this time. If your organization requires specific certifications, contact [email protected].
Single Sign-On (SSO)
Section titled “Single Sign-On (SSO)”SAML-based SSO is available for enterprise organizations. Refer to the SSO setup guide for configuration details.