DriversRecommendedOutdated drivers can make a good PC feel brokenScan driver issues before chasing fixes manually.Scan NowHalloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsWindows FixRecommendedWindows errors stealing your time? Find the fix fastScan stability, cleanup and performance issues.Fix Now×
FREEDOM251

Freedom251 › Blog › AI testing

What Code and Test Data Do AI Testing Platforms Send to the Cloud?

By Freedom251 Team · · 10 min read

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.

AI testing platforms may send far more than a prompt—or far less than a source-code upload. Depending on the product and feature, cloud processing can involve test definitions and values, commit metadata, execution results, logs, screenshots, rendered page structure, network traffic, attachments, prompts, and AI tool results. The practical answer is feature-specific: find out what is sent, when it is sent, where it goes, and how long each recipient keeps it before enabling the feature.

What information can an AI testing platform send?

The payload depends on the work the platform is doing. A cloud runner needs files and configuration to execute a test; an AI assistant needs the prompt and whatever context is supplied to answer it; test-selection analytics may process code and test metadata to estimate which tests matter. These are distinct data flows, even when one vendor offers them all.

As an Amazon Associate I earn from qualifying purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Data sent to a platform or its AI provider can include:

  • Code and test content: source files, test scripts, test definitions, test steps, requirements, or project context.
  • Identifiers and metadata: commit SHA, branch, timestamps, author details, changed-file lists, test names and paths, suite associations, outcomes, and durations.
  • Execution artifacts: terminal output, logs, screenshots, videos, browser console messages, and operating-system or CI environment details.
  • Application observations: rendered DOM and CSS, network requests and responses, page controls, properties, labels, and values.
  • AI task material: prompts, optional project context, attached files, resources taken from HTTP history or a site map, agent messages, tool calls, and tool results.

Those categories can expose sensitive information even when a vendor says it does not collect application source code. A screenshot may show customer records; a request or console log may reveal a token; a test value may identify a real person. Assess the actual artifacts and fields, not just whether a product uploads a repository.

#1 Best Overall
Sale
TOZO A1 Wireless Earbuds Bluetooth 5.3 Light Weight in Ear Headphones | IPX5 Waterproof,2 Mics for AI Calls,Immersive Premium Sound Bass Headset with Charging Case,32 EQ via App Black
  • [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
  • [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
  • [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
  • [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
  • [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.

Why do different features send different data?

Start with the feature’s purpose: it usually explains why particular information is needed. Running tests in a hosted environment, analyzing a failure, choosing a smaller test set, replaying a browser session, and generating a test from a prompt do not require identical inputs.

Cloud execution

A hosted runner must obtain the suite and associated data needed to execute it. Katalon describes Studio as a desktop application and separately documents a flow in which Cloud Execution loads test suites and related data from external repositories, runs scripts in cloud environments, and transfers results to Katalon True. Katalon True stores test cases, suites, and execution information. Those product paths should not be conflated with an AI prompt flow. See Katalon’s Security and Privacy FAQ.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Test selection and analytics

CloudBees Smart Tests uses source and test-file content to create vector embeddings for test selection, according to its data privacy and protection documentation. CloudBees says the original source content is deleted after embedding, while embeddings are retained. Its CLI also sends commit metadata and test results; metadata can include the commit SHA, branch, timestamps, author details, changed-file lists, test paths and names, outcomes, durations, and suite associations. An embedding is not the original source file, but it is still derived from that content and should be treated as a retained data product.

Run recording and replay

Recorded-run services can retain artifacts so teams can diagnose or replay what happened. Cypress Cloud documents terminal output, test results, test definitions, configuration other than Cypress environment variables, screenshots, videos, and OS environment variables related to CI and Git for recorded runs. Test Replay adds rendered DOM and CSS, Cypress commands and events, network traffic, and browser console logs. Cypress says Cloud AI may share test content with a session-bound AI model when enabled, and that it does not capture application or repository code. The distinction is important: not capturing source code does not mean a run contains no sensitive application data. The details and controls are in Cypress’s data storage and controls documentation.

Rank #2
Smart Watch for Men Women Compatible with iPhone Samsung Android Phone 1.69 inch Full Touch Screen IP68 Waterproof Bluetooh Fitness Tracker Heart Rate/Sleep Monitor (Black)
  • 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
  • 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
  • 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
  • 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
  • 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.

AI assistance and security testing

An assistant may transmit a user-selected prompt and contextual information, rather than continuously sending a whole project. Testmo says its AI runs only when a user explicitly chooses it, and that inputs can include optional context such as domain terms or project information. Testmo also says customer AI inputs and outputs are not used to train or improve underlying LLMs. These statements concern Testmo AI as described in its AI data policy; they should not be generalized to every integration or contract.

PortSwigger documents Burp AI and Burp AT as separate scopes. Burp can send an HTTP request or vulnerability description to PortSwigger AI infrastructure. Burp AT task data can also include prompts, attached resources, files, agent messages, tool calls, and their results. PortSwigger says Burp AT does not upload the Burp project, but sensitive requests, responses, resources, and files may be sent without redaction. Its AI trust and data handling page, dated October 22, 2026, makes the selected test scope and approval controls especially relevant.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What do documented platform policies say?

The following examples show why a single claim such as “the AI uploads your code” or “the service never sends code” is too broad. Each row describes only the product or feature named and the vendor’s published account of it.

Product or feature Documented data flow Key scope point
Testmo AI User-submitted input and optional context, such as domain terms or project information, go to an LLM. Testmo says use is explicit and inputs and outputs are not used to train or improve underlying LLMs.
Katalon Studio project data is typically on the engineer’s workstation; Cloud Execution loads suites and related data from external repositories, runs scripts in cloud environments, and transfers results to Katalon True. Studio, Cloud Execution, Katalon True, and AI services have different paths and controls.
Cypress Cloud Recorded-run artifacts include test definitions and results, screenshots, videos, terminal output, selected configuration and CI/Git environment information. Test Replay adds DOM/CSS, network traffic, commands, events, and console logs. Cypress says Cloud AI can share test content with a session-bound model when enabled; it says it does not capture application or repository code.
CloudBees Smart Tests CLI sends commit metadata, test results, and source content used to produce embeddings; test and commit metadata are also processed. CloudBees says source and test-file content is deleted after embedding and that embeddings are retained.
TestingBot AI Opt-in failure analysis can send a small text-only test slice; visual region naming can send screenshot crops around changes. TestingBot says detectable secrets and PII in text are masked, but screenshot crops are not. It says AI data may go to US subprocessors while core testing infrastructure is in Europe.
Burp AI and Burp AT Depending on the task, data can include HTTP requests, vulnerability descriptions, prompts, resources, attachments, files, agent messages, tool calls, and results. PortSwigger says Burp AT does not upload the Burp project; sensitive task data may be sent without redaction.
AssertThat Autonomous Test Management Test data is stored in Atlassian Forge storage; AI uses Atlassian-hosted models, with prompts and results staying within Atlassian. AssertThat says the app makes no calls to external services. This applies to the named Forge application, not all Jira apps or Atlassian AI.
Tricentis Tosca Agentic Test Automation Inputs can include test cases and steps, requirements, execution logs, and screenshots with application labels, controls, properties, and values. The Tosca 2026.1 policy describes tenant-region processing, up to 24 hours in a processing database, and up to 30 days for traces or feedback and in Microsoft Azure OpenAI systems.

Where is the data processed, and how long is it retained?

“In the cloud” does not identify every recipient or location. A vendor’s cloud, a model provider’s service, a tenant’s selected region, and a subprocessor may be separate stages. Ask which feature routes data to which service, and whether the route follows the tenant region or crosses it.

Rank #3
Sale
New Bee Guitar Cable 10ft Electric Instrument Bass AMP Cord | 6.35mm Jack, Durable Design, Stage and Home Studio Use, Low Noise Shielded Electric Cord for Bass, Keyboard, Amp, Mixer
  • [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
  • [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
  • [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
  • [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
  • [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by

Published retention statements also have different scopes. TestingBot says AI provider inputs and outputs are deleted within 30 days, and says its AI data can be sent to US subprocessors even though its core testing infrastructure is in Europe. Tricentis’s Tosca 2026.1 policy specifies up to 24 hours in a processing database, up to 30 days for traces or feedback, and up to 30 days in Microsoft Azure OpenAI systems. These are vendor policy figures, not independent measurements, and they are not interchangeable: one describes TestingBot’s provider data, while the other names multiple Tosca processing and trace stages. Consult the applicable version of the TestingBot Trust Center and Tricentis Tosca policy.

Training language needs the same precision. Testmo says its customer AI inputs and outputs are not used to train or improve underlying LLMs. Tricentis says queries are not used for model training and that PII is anonymized or redacted. Those are distinct vendor statements; neither establishes what every other platform or subprocessor does. The Tosca Cloud policy may describe additional model providers and regions, so verify the actual deployment and version rather than relying on a similarly named product page.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

How should you evaluate a platform before enabling AI?

Compare the exact feature and deployment, not just the company’s general privacy page. A useful review records the payload, trigger, purpose, destination, retention, and controls for each feature.

  1. Identify the feature and trigger. Is data sent during every recorded run, only for cloud execution, after an explicit AI action, or when an administrator enables an opt-in setting?
  2. Inspect a representative payload. Look for scripts, test values, environment details, screenshots, DOM, network requests and responses, prompts, attachments, and tool results. If the product provides a run trace or sample payload, use it to see what actually leaves your environment.
  3. Map each processing recipient. Distinguish the platform’s own infrastructure from model providers, subprocessors, and a customer-selected model key. Check the tenant region and any routing outside it.
  4. Read retention and training terms by data type. Find out what is retained, for how long, and whether the statement covers vendor systems and providers alike. Check the current DPA and the product/version-specific policy.
  5. Verify controls in the relevant feature. Look for opt-in switches, roles and permissions, exclusions, masking, deletion mechanisms, and approval gates. Do not assume a control documented for one feature applies to another.
  6. Test the controls with safe data. Use synthetic values and non-production credentials, then confirm whether sensitive strings are removed from text artifacts and whether images, logs, or network details remain visible.

Masking deserves particular scrutiny. TestingBot distinguishes text masking from screenshot handling: it says detectable secrets and PII in text are masked, while screenshot crops are not. A policy that mentions redaction is not enough unless it identifies the data type and artifacts covered.

Rank #4
BSIMB 15.6" Digital Family Calendar & Chore Chart, No Subscription Fees
  • Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
  • Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
  • All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
  • Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
  • Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.

For applications with strict confidentiality requirements, disable features that are not approved and limit the test scope to the minimum needed. PortSwigger’s description of potentially unredacted requests, responses, resources, and files illustrates why an approval gate and a deliberately scoped target matter in security testing. These are practical safeguards, not a claim that any named service is universally safe or unsafe.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

What does this mean for proprietary code and realistic test data?

Do not treat a vendor’s “we do not collect source code” statement as a blanket guarantee that no sensitive material leaves your environment. It may describe a specific product or artifact category while the same service processes test definitions, logs, screenshots, request bodies, or configuration. Conversely, a vendor that processes source for a stated purpose may describe deletion of the original while retaining derived embeddings or metadata.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

For a meaningful risk decision, make an inventory at the feature level:

  • What exact test or project information is required for the feature to work?
  • Does a human initiate the transfer, or can it happen automatically as part of CI or recording?
  • Could test inputs, screenshots, or requests contain credentials, regulated information, customer data, or unreleased product behavior?
  • Which service receives the data, in what region, and under what retention and training terms?
  • Can your organization exclude sensitive projects or fields, require approval, or turn the feature off?

Then reduce exposure before sending: use synthetic records, short-lived or scoped credentials, and a test environment that does not contain production customer data. Review what is visible in screenshots and logs, not only what is written in the source repository. If the policy does not clearly answer a material question, treat that as unresolved for the specific feature and seek contractual clarification before using real sensitive data.

What should you remember when comparing data policies?

A useful comparison separates payload from purpose and destination. A platform may store a test artifact for replay, transmit source content briefly to create embeddings, or send a narrow user-selected prompt to a model. Those flows have different security implications and cannot be summarized accurately with one company-wide “uploads code” label.

Read the current documentation for the product edition, feature, region, and contract you will actually use. Vendor policy pages explain the vendor’s stated handling; they are not independent audits, and a policy for one feature should not be extended to another.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Frequently Asked Questions

Can an AI testing platform see secrets in my CI environment variables?

It depends on what the specific feature collects. Cypress documents recorded-run configuration other than Cypress environment variables, while also listing certain OS environment variables related to CI and Git; inspect the product’s exact fields instead of assuming all environment data is either included or excluded.

Are screenshots covered by the same masking rules as test logs?

Not necessarily. TestingBot says detectable secrets and PII in text are masked but screenshot crops are not, so a text-redaction statement alone does not answer whether visual artifacts are protected.

Does deleting source files also delete data derived from them?

Not always. CloudBees says original source and test-file content is deleted after it is processed into embeddings, while the embeddings are retained; ask separately about derived representations and metadata.

Can I rely on a vendor privacy page as a contract guarantee?

A public policy describes the vendor’s stated practices, but coverage can depend on edition, deployment, region, and contract. For regulated or confidential data, check the current DPA and applicable product terms for binding scope.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

AI testingcloud securityData privacysoftware testingtest automation

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Recommended PC Tool
Recommended PC Tool
PC Slower Than It Used to Be?Free scan - under a minute
Outdated Drivers Are Slowing You DownFree scan - exact matches

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.