> ## Documentation Index > Fetch the complete documentation index at: https://www.minitap.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # Security, data and hosting > Where Minitap runs, what data a test run moves and keeps, what the AI models see, and how to start a security review. This page answers the questions a security review asks first: where Minitap runs, what Mini sees, what we keep and for how long, and where each audit stands. For documents under NDA and the subprocessor list, open the [trust center](https://trust.minitap.ai). ## What a test run moves ```text theme={"theme":{"light":"github-light","dark":"vesper"}} Your environment Minitap cloud (EU or US) Models ---------------- ------------------------ ------ App build ──────▶ Device or browser runs ──────▶ Screens and page text Test accounts your scenarios Scenario and criteria Repo and tickets Code and ticket context you connect Production data and production credentials stay with you. Mini never asks for them. ``` ## Where it runs | Option | Where it runs | Who holds the keys | Plan | | - | - | - | - | | **Managed cloud** | Minitap's cloud, in the EU or the US, your choice | Minitap. Encrypted in transit and at rest. | Every plan | | **Dedicated instance** | An instance, database and storage of your own, run by Minitap in your region | Minitap, for your instance alone | Enterprise | | **Your cloud** | Your own cloud account | You | Enterprise | | **Your servers** | Your own data centre | You | Enterprise | In your cloud or on your servers, runs stay inside your network, except the calls to the model providers. On any plan, Mini tests a staging URL or a pull-request preview that our cloud can reach. On Enterprise, a private network connector runs inside your network so runs reach staging behind your firewall, and devices can use VPN mode. For apps that block cloud traffic, a residential proxy routes runs through another country. ## What the models see Mini sends a model only what a test needs: * Screenshots and page text from the device or browser. * The scenario and its acceptance criteria. * Code, ticket and doc context, when Mini writes or updates a test. Mini uses models from Anthropic, Google, OpenAI, ByteDance and Alibaba, through a single model gateway. Providers may process requests outside your region, under standard contractual clauses. The model providers never reach your systems. * **No training.** Minitap does not use customer content to train models, on any plan. Aggregated usage metrics, which identify no customer, are used to run and improve the service. * **Never shared.** Your content is never shown to another customer, or sold. * **Zero data retention** at the model providers is available on request on Scale and Enterprise. Before you go live, we walk you through the provider terms that apply to your account. * **Steering attempts are caught.** Mini checks every chat message before the model sees it. A scenario that tries to steer Mini away from testing your app is stopped and flagged for your team. ## What we keep, and for how long | Data | Kept | | - | - | | Test results and recordings | 90 days at most | | Sensitive test data | 30 days at most | | Your content when your contract ends | Deleted within 30 days | | In your cloud or on your servers | Your policy | In the dashboard, a run's video, screenshots and transcript are deleted 90 days after the run. Verdicts stay while the issue is open. Test account passwords are encrypted per workspace and never shown in a report. App secrets you give Mini for API calls stay in the app's vault: Mini sees their names, never their values. ### What not to give Mini Production data or production credentials, real payment card data (sandbox test cards are fine), health data and children's data. Sign-up codes and magic links go to Mini's own [test inboxes](https://www.minitap.ai/docs/minitest/setup/test-inboxes.md). ## Access and sign-in | Control | Plan | | - | - | | Sign in with email and password, Google or GitHub | Every plan | | Owner, Admin and Member roles | Every plan | | Roles per app | Enterprise | | Revocable API keys for the CLI and CI; the GitHub Action signs in with OIDC | Every plan | | Single sign-on with SAML or OIDC, SCIM provisioning, audit logs streamed to your SIEM | Enterprise | > [!NOTE] > > Enterprise identity features are part of the Enterprise plan. Ask the Minitap team what is live for your contract before your review. ## Audits and compliance Statuses as of 5 October 2026. | Item | Status | | - | - | | **SOC 2 Type II** | Our audit is in progress. Our controls are monitored continuously, and documents are shared under NDA in the trust center. | | **GDPR** | In progress. Today we offer a DPA, standard contractual clauses and the UK addendum, our [privacy policy](https://www.minitap.ai/privacy), and [privacy@minitap.ai](mailto:privacy@minitap.ai) for requests. | | **Data processing agreement** | On request, signed with your contract as part of your security review. | | **Subprocessors** | The full list is in the [trust center](https://trust.minitap.ai). | | **Penetration test, incident response, RTO and RPO** | Not published yet. Ask us for their status before your review. | Uptime is 99.5% a month: a target on Team and Scale, a commitment with service credits on Enterprise. Live status and incident history are at [status.minitap.ai](https://status.minitap.ai), and the [Service Description](https://www.minitap.ai/service-description) has the details, with support hours and response times. ## Request a security review **1. Read the trust center** [trust.minitap.ai](https://trust.minitap.ai) holds the subprocessor list and the documents we share under NDA. **2. Bring your questionnaire** [Book a call](https://cal.com/team/minitap/minitap-get-access?overlayCalendar=true). We run Mini on your app and answer your security questions. **3. Sign the DPA** The data processing agreement is signed with your contract. Report a vulnerability to [security@minitap.ai](mailto:security@minitap.ai). Send data requests to [privacy@minitap.ai](mailto:privacy@minitap.ai). ## Next steps > [card] [How Mini tests](https://www.minitap.ai/docs/minitest/get-started/how-mini-tests.md) > > What Mini does on the device, and how it decides each verdict. > [card] [Private apps](https://www.minitap.ai/docs/minitest/setup/private-apps.md) > > Test an app behind your firewall or one that blocks cloud traffic. > [card] [Test accounts](https://www.minitap.ai/docs/minitest/setup/test-accounts.md) > > The accounts Mini signs in with, one per kind of user. > [card] [Trust center](https://trust.minitap.ai) > > Subprocessors and documents under NDA. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.