Privacy Policy.
At Testiva AI, Inc. (testiva.xyz), we build autonomous software testing agents for security-conscious engineering teams. This policy explains what data we collect, how we isolate your staging environments, and why your proprietary code is never used to train AI models.
Zero Model Training
We never train or fine-tune foundation models on your DOM trees, screenshots, network logs, or source code.
Edge PII Scrubbing
Emails, JWTs, API keys, and payment fields are hashed in-memory before leaving the headless browser sandbox.
Ephemeral MicroVMs
Every test run executes inside a single-tenant Firecracker MicroVM that is cryptographically shredded upon completion.
Information We Collect
We collect only the minimum information required to provision your workspace, execute autonomous QA runs, and deliver bug diagnostics:
-
Account & Workspace Metadata: Name, work email address, organization slug, and OAuth provider identifiers (GitHub, GitLab, Google) when you sign in to
testiva.xyz. - Test Execution Artifacts: Target staging URLs, sanitized DOM snapshots, session replay videos, HAR network waterfalls, and browser console logs generated during scheduled or CI-triggered runs.
- Scoped Repository Metadata (Optional): When you enable Auto-PR Code Fixes, our GitHub/GitLab App accesses only the specific files referenced in a verified stack trace to synthesize a pull request patch.
Autonomous Swarm & Edge PII Redaction
When Testiva AI's Explorer, Hunter, Security, or Performance agents interact with your application, our deterministic Edge Scrubber automatically sanitizes sensitive data before it is stored or processed by our Vision-Language Model (VLM):
data-testiva-mask → Gaussian Pixel BlurStrict Zero-Training AI Policy
Testiva AI operates under a strict, contractually binding Zero-Data-Retention (ZDR) and Zero-Training Policy for all AI inference calls:
Customer data—including application screenshots, DOM structures, test cases, bug reports, and repository source code—is never used to train, fine-tune, or improve shared foundation models, nor is it shared with third-party AI providers for model training purposes. Each customer workspace is cryptographically isolated using dedicated tenant encryption keys (AWS KMS AES-256).
Data Retention & Cryptographic Deletion
You control the lifecycle of your test artifacts directly from your workspace settings:
Upon account termination or manual deletion request, all associated workspace artifacts and encryption keys are permanently destroyed within 24 hours.
Infrastructure Subprocessors
We partner exclusively with SOC 2 Type II and ISO 27001 certified infrastructure providers under strict Data Processing Addendums (DPAs):
| Subprocessor | Purpose | Region |
|---|---|---|
| Amazon Web Services (AWS) | Firecracker MicroVM Enclaves & KMS Storage | US-East / EU-Central |
| Cloudflare, Inc. | Zero-Trust Edge Routing, WAF & DDoS Protection | Global Edge |
| Stripe, Inc. | PCI-DSS Level 1 Subscription Billing | United States / EU |
Your Privacy Rights (GDPR, UK GDPR & CCPA)
Depending on your jurisdiction, you have the right to access, export, rectify, or erase your personal data, restrict processing, and object to automated profiling. Testiva AI does not sell personal information or share user data with cross-context behavioral advertisers.
Enterprise customers requiring a countersigned Data Processing Addendum (DPA) with Standard Contractual Clauses (SCCs) or a HIPAA Business Associate Agreement (BAA) can request one directly via our legal desk.
Contact Our Privacy & Security Team
For privacy inquiries, GDPR/CCPA data subject requests, DPA execution, or vulnerability reports, reach out to our dedicated teams at testiva.xyz: