WCAG 2.2 audits, on request

Enterprise mobile testing: security and compliance

Your security review, answered.

On Enterprise: SSO, SCIM, audit logs and a cloud of your own.

Book a demoSecurity FAQ

Where it runs.

Minitap cloud in the EU or the US; on Enterprise, a dedicated instance or yours.

  • Managed cloud

    Every plan

    Minitap cloud, in the EU or the US.

  • Dedicated instance

    Enterprise

    Your own instance, database and storage, run by us.

  • Your cloud

    Enterprise

    Your AWS, GCP or Azure account. You hold the keys.

  • Your servers

    Enterprise

    Your own data centre. You hold the keys.

Full detail
OptionWhere it runsWho holds the keysNetworkAvailable on
Managed cloudMinitap’s cloud, in the EU or the USMinitap. Encrypted in transit and at rest.A staging URL or pull-request preview our cloud can reach.Every plan
Dedicated instanceAn instance, database and storage of your own, run by Minitap in your regionMinitap, for your instance alone.Private networking to your staging.Enterprise
Your cloudYour AWS, GCP or Azure accountYou.Inside your network, except calls to the model providers.Enterprise
Your servers (on‑prem)Your own data centreYou.Inside your network, except calls to the model providers.Enterprise

Every team, every app, one release view.

Every team’s apps in one workspace. mini checks each release; your team decides.

See the results

  • Every app in one workspace

    iOS, Android and web apps together; roles per app on Enterprise.

  • Runs in parallel

    Plan limits are on Pricing; Enterprise is sized to your release volume.

    Pricing

  • Every pull request, every release

    A comment on each pull request; full regression on each release candidate.

  • Your CI

    The native GitHub Action can gate releases; other CI uses the CLI.

  • Real devices and simulators

    Physical phones on request. Up to 3 devices per mobile test.

  • Suites that keep up

    mini adds, edits and retires tests as each codebase changes.

Identity and access.

SSO, SCIM and audit-log streaming come with Enterprise; roles are on every plan.

  • Single sign-on

    Enterprise

    SAML or OIDC through Okta, Entra ID or Google Workspace, on Enterprise.

  • Provisioning

    Enterprise

    On Enterprise, SCIM adds and removes people with your identity provider.

  • Roles

    Every plan

    Owner, admin and member everywhere; roles per app on Enterprise.

  • Audit log

    Enterprise

    Sign-ins, changes and runs, streamed to your SIEM on Enterprise.

Full detail

  • Keys for CI

    Every plan

    The GitHub Action signs in with OIDC; other CI uses a revocable key.

  • Test accounts

    Every plan

    Passwords encrypted per workspace, never shown in a report.

What happens to your data.

Models see what a test needs. We never train models on your content.

Sent to a model

  • Screenshots and page text
  • The scenario and its acceptance criteria
  • Code and ticket context, when mini writes a test

Model providers

  • Anthropic
  • Google
  • OpenAI
  • ByteDance
  • Alibaba

Through OpenRouter, possibly outside your region. None reaches your systems.

What we never do

  • Train models on your content
  • Show your content to another customer, or sell it
  • Ask for production data or production credentials
Full detail

The gateway and regions

Every call goes through OpenRouter. Providers may process requests outside your region, under standard contractual clauses.

Full subprocessor list

What we keep, and for how long

Recordings
180 days. Your latest 10 runs per app are kept past that, so you always have a baseline.
Platform logs
31 days.
At the model providers
Zero data retention, on request on Scale and Enterprise.
When your contract ends
Your content is deleted within 30 days.

Where each audit stands.

SOC 2 Type II and GDPR are both in progress.

SOC 2 Type II audit status, monitored by OneleetGDPR status, monitored by Oneleet

Statuses as of 5 October 2026.

  • SOC 2 Type II

    In progress

    Our audit is in progress. Oneleet monitors our controls continuously; documents are shared under NDA in the trust center.

    Trust center

  • GDPR

    In progress

    In progress. Today: a DPA, standard contractual clauses and the UK addendum, our privacy policy, and privacy@minitap.ai for requests.

    Privacy policy

  • Data processing agreement

    On request

    Signed with your contract, as part of your security review.

  • Subprocessors

    Available

    The full list is in the trust center.

    See the list

  • Penetration test, incident response, RTO and RPO

    Not published yet. Ask us for their status before your review.

  • Security contact

    Email us.

Support and uptime.

Your plan sets how fast we answer, and Enterprise puts uptime under contract.

Status pageService Description

  • First response

    A P1 within 2 business hours on Enterprise, 4 on Team and Scale.

  • Uptime

    99.5% a month: credits on Enterprise, a target on Team and Scale.

  • Who answers

    A named owner in your Slack on Enterprise; a dedicated channel otherwise.

Full detail
First response, in business hours and days
PriorityTeam and ScaleEnterprise
P14 hours2 hours
P21 day4 hours
P32 days1 day

  • Hours

    Monday to Friday, 9:00 to 18:00 CET, except French public holidays.

  • Service credits

    On Enterprise, 5% of the monthly fee for each 0.5% below 99.5%, up to 25%.

  • Status and maintenance

    Live status on our status page; maintenance announced 48 hours ahead.

Who you are buying from.

  • The team

    10 people in Paris, building mini.

  • Who you contract with

    A Minitap entity in the US, France or the UK.

  • Open-source roots

    mini builds on mobile-use, our open-source mobile agent.

Full detail

  • Minitap, Inc.

    Delaware, United States.

  • MINITAP SAS

    France.

  • MINITAP LIMITED

    United Kingdom.

“We've been working with Minitap for a long time on our mobile apps. They are exceptionally flexible, always ready to adapt their product to our workflow, and their solutions help us verify our apps reliably.”
Mikalai DzmitryieuSenior Software Engineer, Memrise
  • Helmit
  • Memrise
  • Nanogram
  • Impakt
  • Trippin
  • MindStash
  • Clutch

What reviewers ask first.

See a real reportHow mini works
Do you train models on our data?

No. Minitap does not use your content to train models, on any plan. We use aggregated usage metrics, which identify no customer, to run and improve the service.

Do model providers keep our data?

Zero data retention at the model providers is available on request, on Scale and Enterprise. Before you go live, we walk you through the provider terms that apply to your account.Full subprocessor list

What does mini need from us?

A staging build or URL, and test accounts. Sign-up codes and magic links go to mini’s own QA inboxes. Read access to the repositories, tickets and docs you choose, for product context. Never production data or credentials, card data, health data or children’s data.

Can mini reach anything beyond the app it tests?

Only what you give it: a phone or browser, the test endpoints you document, and the sources you connect. Model providers never reach your systems.

Can mini test an app that is not on the public internet?

Yes, on Enterprise, through private networking: a site-to-site VPN or AWS PrivateLink. On any plan, mini tests a staging URL or a pull-request preview that our cloud can reach.

How many runs can go at once?

Your plan sets how many devices and browsers run in parallel, and extra parallel sessions can be added. On Enterprise, we size it to your release volume.

How is Enterprise priced?

Around your release volume, deployment and support. The terms are in your contract, alongside the DPA.

Bring your questionnaire to the demo.

We run mini on your app and answer your security questions.

Book a demoOpen the trust center