Trust
Subprocessors
Who handles customer data on our behalf, why, and where. We'll update this list before adding one.
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Google Cloud | Runs the app, the API and the browser and Android emulator workers; stores run evidence (screenshots, video, traces). | Projects, tests, recordings, run results and evidence; secrets, encrypted. | United States (us-east4, Virginia) |
| Neon | Managed PostgreSQL database for accounts, projects, run records, the credit ledger. | Account records, project and run metadata, billing ledger. | United States |
| WorkOS | Sign-in (email, Google, GitHub) and sessions. | Your email, name and sign-in identity. | United States |
| Dodo Payments | Merchant of record: takes payment for subscriptions and top-ups, issues invoices, handles sales tax and refunds' payment side. | Billing name, email, address and payment details (we never see your card). | Dodo Payments' own locations (see their privacy policy) |
| Resend | Sends our emails (usage alerts, monitor alerts, receipts) and receives mail for hosted test inboxes. | Your email address and the alert text; the emails your tests receive in a hosted inbox. | United States |
| OpenRouter | Routes our hosted AI requests (when you use our AI instead of your own key). | The step text, a text description of the page, sometimes a screenshot. Never secret values. | United States |
| DeepInfra | Runs DeepSeek-V4.1-Flash (fp8) for hosted AI. OpenRouter is told to use only this provider, with zero data retention and no fallbacks. | The same hosted-AI requests. | United States |
| Cloudflare | DNS and hosting of this website and the docs, and delivery of their files. | Standard web-request data (IP address, requested page) for visitors to this website. No cookies, no analytics scripts. | Global edge network |
| GitHub only if you connect it | Only when you connect a repository: reads your tests, posts the pull-request comment and the status check. | Repository contents and pull-request data you grant access to. | United States |
Not subprocessors
The sites you test, and your own AI provider if you bring your own key, receive data because you point the product at them. See security and data. The open-source engine sends nothing to us.
Questions: privacy@optestra.com