AI data use and retention

Momentic uses AI to author steps, act on the page, evaluate page state, recover from transient failures, and find the root cause of failures. These features call hosted model providers. Your tests are YAML files in your own repository, under your own version control. Momentic does not need to hold them.

​

What Momentic sends to a model provider

Momentic sends prompts, page context, screenshots and image-derived inputs, accessibility and HTML snapshots, step traces, and the AI output itself to a model provider. Momentic does not crawl, ingest, or retrieve private documents or document repositories. It reaches only the applications, pages, and artifacts that your test is configured to use.

​

Model providers

Momentic uses hosted third-party providers across several vendors for reliability: Anthropic, OpenAI, Google Vertex, xAI, Mistral, AWS Bedrock, and Microsoft Azure. Momentic has zero-data-retention agreements in place with all model providers. See the sub-processor table on Privacy and security.

​

What we keep, and for how long

AI memory and step caches are scoped per organization and reachable only by authenticated runs. See AI memory and Step caching.

​

Who can see it

Internal access to logs and AI traces is gated by SSO and role-based access controls. Access is limited to authorized Momentic personnel with a business need. Momentic engineers use logs and traces when you ask for debugging help. You control dashboard access with your own roles and SSO. See API keys and team settings. You can separate API keys per user, CI pipeline, and environment.

​

Model training

Data from self-serve accounts may be used to improve Momentic’s agents. Enterprise customers can opt out of training entirely or agree to a custom fine-tuning arrangement. Enterprise customers can also get a zero-data-retention policy. Momentic does not store your context as vector embeddings. To opt out, ask your account team or write to support.

​

Keep sensitive data out of a test run

Run tests against dedicated test environments with faked or cleaned data. Do not put production PII, confidential documents, or unnecessary secrets in test flows. Keep credentials in environment variables or CI secret storage, not in test steps. Momentic does not process PII during tests.

​

How the agents are constrained

Agents receive structured page data, including screenshots and simplified HTML, and must return commands through strict tool schemas. Arbitrary free-form instructions to the model are not accepted. Prompts require agents to target elements that exist on the current page, avoid inventing elements or test data, and fail rather than guess. Every output is validated against a schema and executed by deterministic automation code. Webpage content, traces, and prior run memory are treated as untrusted input.

​

Certifications and reports

Momentic is SOC 2 Type 2 certified. The Trust Center has SOC 2 and annual penetration test reports. Read the privacy policy for privacy details. See Privacy and security for the sub-processor list.