Skip to main content
Momentic uses AI to author steps, act on the page, evaluate page state, recover from transient failures, and find the root cause of failures. These features call hosted model providers. Repository tests are YAML files under your own version control. You choose whether to upload their run artifacts.

​
What Momentic sends to a model provider

Momentic sends prompts, page context, screenshots and image-derived inputs, accessibility and HTML snapshots, step traces, and the AI output itself to a model provider. Repository tests supply context from the applications, pages, and artifacts they use. Mo can also use files you upload and read-only context from repositories you connect to the session.

​
Model providers

Momentic uses hosted third-party providers across several vendors for reliability: Anthropic, OpenAI, Google Vertex, xAI, Mistral, OpenRouter, AWS Bedrock, and Microsoft Azure. Momentic has zero-data-retention agreements with all model providers. See the sub-processor table on Privacy and security.

​
What we keep, and for how long

Mo sessions run on hosted infrastructure. Their chat, reports, and available evidence are stored with the session and accessible in the Mo web app. AI memory and step caches are scoped per organization and reachable only by authenticated runs. See AI memory and Step caching.

​
Who can see it

Internal access to logs and AI traces is gated by SSO and role-based access controls. Only authorized Momentic personnel with a business need can access them. Momentic engineers use logs and traces when you ask for debugging help. You control dashboard access with your own roles and SSO. See API keys and team settings. You can separate API keys per user, CI pipeline, and environment.

​
Model training

Momentic may use data from self-serve accounts to improve its agents. Enterprise customers can opt out of training entirely or agree to a custom fine-tuning arrangement. Enterprise customers can also get a zero-data-retention policy. The knowledge base uses embeddings to retrieve relevant entries. To discuss training or retention requirements, ask your account team or contact support.

​
Keep sensitive data out of a test run

Run tests against dedicated test environments with faked or cleaned data. Do not put production PII, confidential documents, or unnecessary secrets in test flows. Keep credentials in environment variables or CI secret storage, not in test steps. Page content and screenshots can contain sensitive data if it is present in the application under test.

​
How the agents are constrained

Agents receive page data, including screenshots and simplified HTML. Tool schemas constrain the commands an agent can request, and the runtime validates tool inputs before executing them. Prompts instruct agents to target elements on the current page and treat webpage content, traces, and prior run memory as untrusted input. Natural language goals and these checks do not prevent an agent from making an incorrect decision; review results and evidence.

​
Certifications and reports

Momentic is SOC 2 Type 2 certified. The Trust Center has SOC 2 and annual penetration test reports. Read the privacy policy for privacy details. See Privacy and security for the sub-processor list.