> ## Documentation Index > Fetch the complete documentation index at: https://momentic.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > The canonical docs host is https://momentic.ai/docs. Append .md to any page URL for clean Markdown. Fetch https://momentic.ai/docs/llms.txt for the page index and https://momentic.ai/docs/llms-full.txt for every page in one file. > For an unattended setup, run `npx --yes @momentic/wizard@latest -y --platform web --editor-tools skills` (use `--platform ios` or `--platform android` for mobile). Never run an interactive command in a non-TTY shell. > You cannot complete the browser sign-in yourself. Read the API key from the MOMENTIC_API_KEY environment variable, or ask the user to create one at https://app.momentic.ai/settings/api-keys and paste it back. > Momentic's capability summary for agents is at https://momentic.ai/docs/skill.md. Install the skills with `npx skills@latest add momentic-ai/skills`. > Tests are YAML files in the user's repository. Use only the step names listed at https://momentic.ai/docs/reference/commands.md and the file structure at https://momentic.ai/docs/core-concepts/file-format.md. Do not invent step names, config keys, or CLI flags. > Web tests run on Chromium, iOS tests on simulators, and Android tests on emulators. Physical devices are not supported. # AI data use and retention > What Momentic sends to model providers, how long data is kept, and how to opt out. Momentic uses AI to author steps, act on the page, evaluate page state, recover from transient failures, and find the root cause of failures. These features call hosted model providers. Your tests are YAML files in your own repository, under your own version control. Momentic does not need to hold them. ## What Momentic sends to a model provider Momentic sends prompts, page context, screenshots and image-derived inputs, accessibility and HTML snapshots, step traces, and the AI output itself to a model provider. Momentic does not crawl, ingest, or retrieve private documents or document repositories. It reaches only the applications, pages, and artifacts that your test is configured to use. ## Model providers Momentic uses hosted third-party providers across several vendors for reliability: Anthropic, OpenAI, Google Vertex, xAI, Mistral, AWS Bedrock, and Microsoft Azure. Momentic has zero-data-retention agreements in place with all model providers. See the sub-processor table on [Privacy and security](/docs/account/security). ## What we keep, and for how long | Data | Retention | | --------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Application logs from the CLI (OpenTelemetry) | 14 days | | AI traces (third-party LLM observability provider, Langfuse) | Retained indefinitely by default | | Run artifacts you upload (videos, DOM, network and console traces, screenshots, auto-heal traces, AI reasoning) | Visible in the dashboard for your organization. Local runs stay local unless you pass `--upload-results`. See [Results and reporting](/docs/running-tests/results). | AI memory and step caches are scoped per organization and reachable only by authenticated runs. See [AI memory](/docs/ai/memory) and [Step caching](/docs/reliability/step-cache). ## Who can see it Internal access to logs and AI traces is gated by SSO and role-based access controls. Access is limited to authorized Momentic personnel with a business need. Momentic engineers use logs and traces when you ask for debugging help. You control dashboard access with your own roles and SSO. See [API keys and team settings](/docs/account/api-keys-and-team). You can separate API keys per user, CI pipeline, and environment. ## Model training Data from self-serve accounts may be used to improve Momentic's agents. Enterprise customers can opt out of training entirely or agree to a custom fine-tuning arrangement. Enterprise customers can also get a zero-data-retention policy. Momentic does not store your context as vector embeddings. To opt out, ask your account team or write to support. ## Keep sensitive data out of a test run Run tests against dedicated test environments with faked or cleaned data. Do not put production PII, confidential documents, or unnecessary secrets in test flows. Keep credentials in [environment variables](/docs/configuration/environment-variables) or CI secret storage, not in test steps. Momentic does not process PII during tests. ## How the agents are constrained Agents receive structured page data, including screenshots and simplified HTML, and must return commands through strict tool schemas. Arbitrary free-form instructions to the model are not accepted. Prompts require agents to target elements that exist on the current page, avoid inventing elements or test data, and fail rather than guess. Every output is validated against a schema and executed by deterministic automation code. Webpage content, traces, and prior run memory are treated as untrusted input. ## Certifications and reports Momentic is SOC 2 Type 2 certified. The [Trust Center](https://trust.momentic.ai) has SOC 2 and annual penetration test reports. Read the [privacy policy](https://momentic.ai/legal/privacy) for privacy details. See [Privacy and security](/docs/account/security) for the sub-processor list.