--- title: "Security and AI data use | Momentic" description: "What Momentic sends to AI models, how long it keeps that data, who can read it, and what an Enterprise agreement changes. SOC 2 Type 2." canonical: "https://momentic.ai/security" last-updated: "2026-10-06T23:04:30Z" --- # Security and AI data use Momentic has zero-data-retention agreements with its AI providers. We scrub configured request headers from network traces. Enterprise customers can opt out of training and set custom retention policies. - **SOC 2 Type 2:** Certified. Ask us and we send the report. - **Penetration tests:** A third party tests us every year, and the reports are in the Trust Center. - **Sub-processors:** Every sub-processor is published, including the AI providers. - **SSO, roles and audit logs:** SAML and OIDC on Enterprise. ## Certifications Momentic is SOC 2 Type 2 certified. The Trust Center holds the report, the security practices and the annual penetration test reports. Links: - [Trust Center](https://trust.momentic.ai/) - [Sub-processors and security docs](/docs/account/security) - [Privacy policy](/legal/privacy) - [Terms of service](/legal/tos) ## Data sent to AI AI requests can include test instructions, screenshots, page structure, step traces, and model outputs. Uploaded runs can include videos, screenshots, browser logs, and AI traces. Mo can also use uploaded files, read-only repository context, and Knowledge base guidance. Use test environments with cleaned data. ## Model providers Momentic uses several hosted model providers: Anthropic, OpenAI, Google Vertex, xAI, Mistral, OpenRouter, AWS Bedrock and Microsoft Azure. Momentic has zero-data-retention agreements with these model providers. AI traces stored in Langfuse follow the retention policy below. Every model provider, and Langfuse, the observability provider that stores AI traces, is listed in the public sub-processor list. ## Infrastructure and encryption Momentic runs on Google Cloud Platform. Data is encrypted in transit and at rest. The public security docs list every sub-processor, with the purpose of each one. The list includes the AI providers, the hosting provider, and the tools we use to run the company. Links: - [Sub-processor list](/docs/account/security) ## Retention | Data | Retention | | --- | --- | | Application logs from the CLI (OTEL) | 14 days | | AI traces, in our observability provider Langfuse | Retained indefinitely by default | | Run artifacts in the dashboard | See your plan's results retention | Momentic engineers read this data to debug a run when you ask us to. Internal access to the logs and to the traces is gated by SSO and role-based access control, and is limited to staff with a business need. An Enterprise agreement can add a zero-data-retention policy. ## Training Data from self-serve accounts can be used to improve Momentic's own agents. Enterprise customers can opt out of that use entirely, or agree a custom fine-tuning arrangement. ## Access control Create separate API keys for each developer, CI pipeline, and environment so you can rotate or revoke them independently. The key value is shown once. SAML and OIDC single sign-on are available on Enterprise, and only an admin can manage the connection. Roles control workspace access, billing and membership. Audit logs cover administrative actions. ## Your tests stay in your repository A Momentic test is a YAML file in your own repository. You review it in a pull request, and npx momentic run executes it on your machine and in your CI. Your Git history is the audit trail. ## Questions ### Does Momentic train on my test data? On self-serve plans, yes. Data from those accounts can be used to improve Momentic's own agents. Enterprise customers can opt out of that use entirely, or agree a custom fine-tuning arrangement. ### Which AI providers does Momentic send my data to? Anthropic, OpenAI, Google Vertex, xAI, Mistral, OpenRouter, AWS Bedrock and Microsoft Azure. AI traces are stored in Langfuse. Momentic uses multiple providers for availability. ### What does Momentic send to a model? The step instruction, page context, screenshots, an accessibility or HTML snapshot of the page, step traces, and the model output itself. ### How long does Momentic keep my data? Application logs from the CLI are kept for 14 days. AI traces in Langfuse are retained indefinitely by default. Run artifacts in the dashboard follow your plan's results retention. ### Can I get zero data retention? Yes, under an Enterprise agreement. That agreement can add a zero-data-retention policy. ### Is Momentic SOC 2 compliant? Yes, SOC 2 Type 2. Ask us for the report, or read the security practices and the annual penetration test reports in the Trust Center. ### Does Momentic need access to my production environment? No. Point tests at a staging or test environment, and use faked or cleaned data. Repository tests use the applications and artifacts you configure. Mo also uses the files and read-only repository context you supply. ### Who at Momentic can read my run data? Momentic engineers read it to debug a run when you ask us to. Internal access is gated by SSO and role-based access control, and is limited to staff with a business need. ### Is my data encrypted? Yes, in transit and at rest. Momentic runs on Google Cloud Platform. ### Can I take my tests with me? Yes. A Momentic test is a YAML file in your own repository. You review it in a pull request, and npx momentic run executes it on your machine and in your CI. Your Git history is the audit trail. ## Need the paperwork? Enterprise agreements cover zero data retention, training opt-out, SSO and audit logs. Talk to us and we will send the SOC 2 report. For a security question or a vulnerability report, write to support@momentic.ai. [Contact sales](/sales)