CorrectestThe correct way to test Request a pilot
TRUST CENTER · UPDATED SEPTEMBER 2026

What's true, what's in build, what we don't have yet.

We're a small company, early in our life. You won't find a badge wall here, because we haven't earned the badges yet. What you'll find instead is a precise account of how Correctest handles your application and its data — kept current, stated plainly.

TRUE TODAY Verifiable in the product as it exists now.
No training on customer data. AI calls go to Anthropic's commercial API, which does not train on our inputs. Your app's content is used to build your KB — nothing else.
Credentials are sealed. Test-account credentials are AES-256-GCM encrypted at rest, masked at five distinct boundaries, never shown to the AI, and never embedded in generated tests.
Synthetic test data only. The agent generates its own inputs. It never needs, requests, or submits your real user data.
Invalid-input replays are built to be rejected — and when your app accepts one anyway, that is reported, not hidden. Every invalid submission carries a value your app should refuse. When your app refuses it, nothing is written. When your app accepts it, the write lands and Correctest lists it as a validation gap (eleven of them in a single scan of our own test app). Happy-path flows submit real forms and do create records, so point scans at a staging environment seeded with test data. An optional reset-endpoint hook ships in the generated project for teams that have one; none is required.
Generated suites contain zero AI. Plain deterministic Playwright. No calls to us, no calls to any model, from your CI.
Immutable, cost-capped scans. Every scan is a frozen snapshot with a hard spend ceiling it cannot exceed.
Tenant isolation. Every scan, page, and stored artifact belongs to exactly one customer through a customer-scoped ownership spine. Every request is checked against the caller's customer and fails closed on any mismatch.
Per-client, per-application storage vaults. Screenshots, snapshots, and generated projects are stored under a path keyed to the owning customer and application — one client's artifacts are separated from another's, and deleting a single app or a whole account is a clean sweep of that path.
Deny-by-default authentication, and an admin console at its own address. Every client-facing route requires a signed-in session and fails closed without one. The operator console is served as a separate site with its own sign-in, so a client session can never reach it.
Staff-access audit log. When a Correctest operator opens a customer's data, it is recorded — who, which customer, when — in an append-only log, so cross-tenant access is provable, never implicit.
Export your data anytime. A self-serve download of your full knowledge base and generated suites is available whenever you want it — not gated behind a support ticket.
Offboarding with a 30-day grace. When an account is closed, its data stays recoverable for 30 days — with one-click undo — before permanent deletion. A wrong click or a returning customer is not a catastrophe.
Per-application deletion. You can permanently delete all data for one of your applications while the rest of your account stays intact — behind an export-first offer and a type-the-name confirmation.
IN BUILD Decision recorded. Not live yet.
Mandatory MFA on Correctest accounts
NOT YET We don't have these. We won't imply otherwise.
SOC 2 / ISO 27001. Not certified. On the roadmap once the in-build controls above are live and audited.
Third-party penetration test. Not yet commissioned.
EU data residency / own-cloud tier. Compute and the database are in Singapore, and object storage is in Oceania. We cannot host your data in the EU, and a dedicated tier in your own cloud is planned, not available.
HIPAA / BAA. Not supported. Don't point Correctest at applications containing PHI.
How your credentials are protected: Encrypted at rest with AES-256-GCM; Never shown again; You stay in control; Delete anytime; Handled with care
The Credentials page, as it reads in the product. Screenshots on this page are of Correctest scanning its own test application on a development stack. Only the account email and the host name were replaced; nothing the product reported was altered.
DATA FLOW

What we touch, where it lives, what reaches the AI

What we touch
  • Your application's pages, forms, and flows — as rendered
  • Test-account credentials you provide (encrypted, masked)
  • Docs you choose to upload for conformance checking
  • Scan video recordings — only if you switch recording on for an application: short clips of what the browser did, kept for about a month after the scan, then deleted

Not your production database. Not your source code. Not your users' data.

Where it lives
Render (compute + PostgreSQL) — Singapore
Cloudflare R2 (screenshots, recordings, generated projects) — Oceania
Cloudflare Pages (this app)
Anthropic (AI processing)
Clerk (sign-in)
Sentry · PostHog (error + product analytics)

The database sits beside the compute on a private network and is never exposed to the public internet. Browsers run on our own worker, so your logged-in sessions never pass through a third-party browser service.

Standard managed infrastructure — no exotic hosting you'd need to assess separately.

What reaches the AI
  • Page structure and visible content, for classification
  • Synthetic inputs and observed outcomes
  • Your uploaded docs, for conformance comparison

Never credentials. Never real user data — there isn't any in the pipeline to begin with.

ONE THING WE DO THAT YOU SHOULD KNOW ABOUT

We learn from anonymized failure patterns pooled across customers — e.g. "selector strategies that break on infinite-scroll listings." App identity, URLs, content, and anything traceable to you are stripped before data crosses that boundary. If that isn't acceptable for your organisation, raise it in the pilot conversation.

SEVEN QUESTIONS, ANSWERED IN PUBLIC

The questions security reviewers actually ask

01Are you SOC 2 certified?
No. We haven't started a SOC 2 audit. Some of the controls an audit would check are live today — tenant isolation and the staff-access audit log are in the "true today" ledger above — and mandatory MFA is in build. We'd rather tell you this directly than decorate the page.
02You're a small company — what happens if you disappear?
Your exported knowledge base and your generated test suite are fully usable without us — the tests are plain Playwright with zero dependency on our servers. Our infrastructure is standard managed services, not bespoke. And the planned dedicated tier runs in your cloud, which removes us from the critical path entirely.
03Is my application's data used to train AI models?
No. AI processing uses Anthropic's commercial API, which does not train on submitted data. The one adjacent thing we do — learning from anonymized failure patterns pooled across customers — is disclosed above, and specifics are stripped before that boundary.
04Do you ever see our users' real data?
The pipeline is built so it never needs to. All form submissions use synthetic data the agent generates. The only sensitive thing you give us is test-account credentials, which are AES-256-GCM encrypted at rest, masked at five boundaries, never shown to the AI, and never embedded in generated tests. We recommend scanning staging environments seeded with test data.
05Where does our data physically live?
Compute and the database run on Render, with the database beside the compute on a private network and never exposed to the public internet. Scan artifacts — screenshots, recordings and generated projects — live in Cloudflare R2. This application is served from Cloudflare Pages. AI processing goes to Anthropic, sign-in to Clerk, and error and product analytics to Sentry and PostHog. Browsers run on our own worker, so your logged-in sessions never pass through a third-party browser service. Compute and the database are in Singapore; object storage is in Oceania. EU residency and an own-cloud tier are on the roadmap but not available — see "Not yet" above.
06Can we get our data out — or deleted?
Yes. Export-anytime, per-application deletion, and offboarding with a 30-day recoverable grace period are all in the "true today" ledger above.
07Do the generated tests phone home, or call any AI?
No, and you can verify this yourself: the generated project is plain TypeScript you can read line by line. No SDK of ours, no API keys to our service, no model calls. It runs in your CI whether or not our company exists. That's the point of "AI at authoring time, zero AI at runtime."

Have a question this page doesn't answer? Ask it — the answer goes here, publicly.

Ask a trust question
OPERATING AGREEMENTS

What we ask of your organisation, and what we promise back

The plain-English version of the onboarding agreement. It is deliberately short.

WE ASKThree things.
A dedicated Correctest user account in your application. Its own login, not a shared human's credentials. You create it, you set its permissions, and deactivating it is your instant kill switch: every session and token dies with it. Your platform enforces those permissions server-side, so what that account can see is all Correctest can ever see.
Functional testing only. Correctest exercises your application the way a careful human tester would, at human pace, within your authorisation. It is not a load-testing or security-scanning tool, and it must not be pointed at a platform vendor's service for those purposes. Its own scan telemetry records duration and volume, so "well below significant load" is demonstrable.
You own the scope. Correctest tests your application against your observed behaviour. It does not grade, benchmark or monitor the platform your app is built on.
WE PROMISEIn the product, not only on paper.
A reachable human, named at the moment you need one. Wherever the product has to say no — a licence expired, credits exhausted, an application limit reached, an account closed or suspended — it names the address to write to rather than "contact support". We publish no response-time promise yet; the inbox is monitored personally, and we would rather state no service level than one we might not hold.
Named vendors, no surprises. Your data touches a short, disclosed list of infrastructure vendors: database, file storage, AI analysis, identity, and managed cloud browsers when that tier ships. The list lives on this page and in the onboarding agreement.
Credentials are handled as secrets end to end. Encrypted at rest, redacted from every log and artifact, never embedded in generated tests.
Everything Correctest learned is yours and inspectable. The Knowledge Base, the screenshots, the generated test project. Nothing is hidden side-effect state.
When you offboard, your application data is deleted; billing records are retained. Your knowledge base, screenshots and generated suites are removed when you offboard, and scan recordings roll off sooner, at 30 days. Financial records of what we charged you and when are kept, with the link to your closed account severed, the way tax and billing-dispute records normally must be.
A regenerated suite never quietly self-heals wrong, and never quietly drops a check. When a change in your app is worked out confidently, regenerating your suite picks the fix up. When it cannot be worked out confidently, that one check is left out and flagged for you, on the generation record, in the activity feed, and on the "your tests are ready" card itself.
Anything a generation left out is disclosed on the card that says your tests are ready. When there is nothing to report, the card shows no caveat block at all rather than an "all clear" badge: we tell you what we observed, and we never certify what we didn't check. When the fault is ours, the card says so.
If a test needs a real file from you, that file is copied into the test project you receive, and we say so before you send it. Once you commit that project, the file is in your repository and its history. If that is not appropriate for a document, send a stand-in; it proves the step just as well. Inside the project the file is named after its contents, never the name you gave it.