Trulit

Generative AI Policy

Last updated: October 2026

1. Introduction

At Trulit, we are committed to the responsible and transparent use of generative AI. This policy explains which of our features use AI, which providers receive data, exactly what data is sent, and how long Trulit keeps it. It states only what we can verify ourselves.

2. How We Use AI

AI runs only when you invoke one of these features:

  • Test case generation: AI analyzes the requirements text you provide, together with the application type and module you select, and proposes test scenarios and test cases for your review.
  • Automation script generation: AI converts your plain-English test steps into a structured automation script, using a list of interactive elements scraped from the target page you name.
  • Autonomous testing agent and selector healing: during an automated run, AI receives the step description, a trimmed outline of the page under test and screenshots of it, and decides the next action or repairs a broken selector.
  • AI assistant: AI answers questions about your project using the test cases, defects and test runs it looks up on your behalf.

3. Providers, Data Sent and Our Retention

One third party is in the AI data path:

  • Google Cloud, Vertex AI (Gemini models): the AI model provider for every feature above. Requests are made through Google Cloud's Vertex AI API from Trulit's own Google Cloud project, by default in the us-central1 region.

What is sent to Google Cloud, depending on the feature: requirements text you paste or upload; plain-English test steps; page outlines and screenshots of the application under test; and AI assistant conversations together with the test cases, defects and test runs they reference. Card data and account credentials are never sent.

  • Retention on Trulit's side: AI generation sessions and generated test cases are kept in your organization's account, protected by the same row-level security as the rest of your data, until you delete them, your account or your organization. AI assistant conversations are not stored by Trulit. Screenshots captured during automated runs are deleted after 90 days.
  • Encryption: all data is encrypted in transit; stored data is encrypted at rest by our infrastructure providers.
  • How each provider handles data on its side is governed by that provider's own terms, which we do not restate here. Questions about a specific provider's handling can be sent to the contact below.

4. Third-Party AI Services

  • Named providers: Google Cloud (Vertex AI) is the only AI-related subprocessor. It appears in our subprocessor register. Automated tests run in a browser inside our own infrastructure, not in a third-party browser service.
  • Vendor review: we review each provider's security documentation before use and at least annually, as set out in our Vendor and Third-Party Management Policy.
  • Subprocessor list: our current subprocessor list is available on request.

5. Human Oversight

We maintain human oversight in all AI operations:

  • Review and Approval: AI-generated test cases require human review before execution.
  • Override Capability: Users can always override, modify, or reject AI suggestions.
  • Audit Trails: AI usage, generation events and agent decisions are recorded in your organization's account.
  • Quality Assurance: Our team monitors AI outputs for quality and accuracy.

6. AI Limitations

We are transparent about the limitations of AI:

  • AI-generated content may not always be 100% accurate and should be reviewed.
  • AI cannot replace human judgment for critical testing decisions.
  • Complex edge cases may require manual test case creation.
  • AI performance depends on the quality and clarity of input requirements.

7. User Control

You control when AI is used:

  • Invocation only: AI features run only when a user explicitly starts them. No AI processing happens in the background on your data.
  • Metered usage: AI usage is metered through your organization's AI credits, which organization administrators manage.
  • Data deletion: AI-generated content can be deleted like any other record, and account deletion removes it along with the rest of your data.

8. Responsible AI Commitment

We are committed to responsible AI practices:

  • Fairness: We design AI systems to be fair and unbiased.
  • Transparency: We clearly communicate when AI is being used.
  • Accountability: We take responsibility for AI outputs and their impacts.
  • Privacy: We prioritize user privacy in all AI operations.
  • Security: We implement robust security measures for AI systems.

9. Updates to This Policy

We may update this policy as AI technologies and best practices evolve. We will notify users of significant changes through our platform and email communications.

10. Contact Us

If you have questions about our AI practices or this policy, please contact us at ai-policy@trulit.com