Skip to main content
This page answers the questions a security review asks first: where Minitap runs, what Mini sees, what we keep and for how long, and where each audit stands. For documents under NDA and the subprocessor list, open the trust center.

​
What a test run moves

​
Where it runs

In your cloud or on your servers, runs stay inside your network, except the calls to the model providers. On any plan, Mini tests a staging URL or a pull-request preview that our cloud can reach. On Enterprise, a private network connector runs inside your network so runs reach staging behind your firewall, and devices can use VPN mode. For apps that block cloud traffic, a residential proxy routes runs through another country.

​
What the models see

Mini sends a model only what a test needs:
  • Screenshots and page text from the device or browser.
  • The scenario and its acceptance criteria.
  • Code, ticket and doc context, when Mini writes or updates a test.
Mini uses models from Anthropic, Google, OpenAI, ByteDance and Alibaba, through a single model gateway. Providers may process requests outside your region, under standard contractual clauses. The model providers never reach your systems.
  • No training. Minitap does not use customer content to train models, on any plan. Aggregated usage metrics, which identify no customer, are used to run and improve the service.
  • Never shared. Your content is never shown to another customer, or sold.
  • Zero data retention at the model providers is available on request on Scale and Enterprise. Before you go live, we walk you through the provider terms that apply to your account.
  • Steering attempts are caught. Mini checks every chat message before the model sees it. A scenario that tries to steer Mini away from testing your app is stopped and flagged for your team.

​
What we keep, and for how long

In the dashboard, a run’s video, screenshots and transcript are deleted 90 days after the run. Verdicts stay while the issue is open. Test account passwords are encrypted per workspace and never shown in a report. App secrets you give Mini for API calls stay in the app’s vault: Mini sees their names, never their values.

​
What not to give Mini

Production data or production credentials, real payment card data (sandbox test cards are fine), health data and children’s data. Sign-up codes and magic links go to Mini’s own test inboxes.

​
Access and sign-in

Enterprise identity features are part of the Enterprise plan. Ask the Minitap team what is live for your contract before your review.

​
Audits and compliance

Statuses as of 5 October 2026. Uptime is 99.5% a month: a target on Team and Scale, a commitment with service credits on Enterprise. Live status and incident history are at status.minitap.ai, and the Service Description has the details, with support hours and response times.

​
Request a security review

1

Read the trust center

trust.minitap.ai holds the subprocessor list and the documents we share under NDA.
2

Bring your questionnaire

Book a call. We run Mini on your app and answer your security questions.
3

Sign the DPA

The data processing agreement is signed with your contract.
Report a vulnerability to security@minitap.ai. Send data requests to privacy@minitap.ai.

​
Next steps

How Mini tests

What Mini does on the device, and how it decides each verdict.

Private apps

Test an app behind your firewall or one that blocks cloud traffic.

Test accounts

The accounts Mini signs in with, one per kind of user.

Trust center

Subprocessors and documents under NDA.