What Vera stores, and where it goes
What leaves your machine when you run tests, what a connected GitHub repo sends, what is redacted before it reaches an AI model, and how long any of it is kept.
Vera runs tests against your application, so it necessarily sees your application. This page says exactly what that means — what leaves your machine, what is kept, for how long, and who else ever sees it.
It is written to be checkable. Where a claim depends on a specific behaviour, the behaviour is described plainly enough that you can verify it yourself.
The short version
- Running your tests never sends us your source code. The agent executes on your machine and reports results and artifacts.
- Connecting a GitHub repository does send it — temporarily, to propose test rules, and short excerpts are kept as reviewable evidence. This only happens if you connect a repo.
- Vera records your running application — screenshots, video, traces — because that is what a test report is made of.
- AI runs on your own API key. Your prompts go to your provider, not ours.
Running tests
When you run a test with the local agent (vera-agent), the browser and your
application stay on your machine. The agent sends back:
| What | Detail |
|---|---|
| Run results | pass/fail per step, timings, error messages |
| Screenshots and video | images and a recording of the browser during the run |
| Playwright traces | a step-by-step record including DOM snapshots and network timing |
| Console and network logs | whatever your application logged during the run |
| HAR | request and response headers and sizes only — bodies are never captured, and Authorization, Cookie and Set-Cookie values are replaced with [redacted] |
| Page structure, on self-healing only | see below |
No repository content is sent by the agent. When Vera works out which tests a code change affects, it sends file paths only — never file contents.
Self-healing and page structure
If a test step fails because an element moved or was renamed, Vera can ask an AI model to suggest a replacement selector. To do that it sends a snapshot of the page's structure (up to 256 KB).
Before that snapshot leaves your machine, Vera removes:
- the contents of every
<script>block (where API keys, session tokens and bootstrapped user data usually live) - stylesheet and SVG contents
- HTML comments
- the values of
passwordandhiddeninputs — including CSRF tokens - long inlined
data:images and fonts
What remains is the structural markup a selector is built from: tags, ids,
classes, data-testid, roles, labels and visible text. Values typed into
ordinary visible text fields are not removed, because the healer uses them to
tell similar fields apart. On a test run these are normally your fixture data —
if that matters for your application, run without self-healing.
Connecting a GitHub repository
This is optional, and nothing below happens unless you connect a repo.
To propose testing rules from your code, Vera:
- fetches a tarball of the repository at a specific commit,
- extracts it to a temporary directory on Vera's server,
- reads it (read-only — no writes, no command execution),
- deletes the directory when it finishes.
Short excerpts are kept. Each proposed rule stores the file path, the line number, and up to 2,000 characters of the code the rule was read from. That evidence exists so a human can judge whether a proposed rule is real before approving it — rules are never applied automatically. The excerpts are deleted when you delete the rule or the project.
If you would rather Vera never read your repository, don't connect one. Every other part of the product works without it.
AI
Vera is bring-your-own-key. Prompts — including the page snapshots described above — go to the provider you configure (Anthropic, OpenAI or Google) under your own account and their terms.
The one exception is the free onboarding grant: a small, fixed number of AI calls for new workspaces, made with Vera's key so you can try the product before supplying one. Once you add a key, it is always used in preference.
Where data is stored
Vera Cloud runs on Railway in the United States (US West). Run artifacts — screenshots, video, traces — are stored in object storage in the same region. Credentials you give Vera (project logins, API keys, device-cloud tokens) are encrypted at rest.
Retention follows your plan. Runs and their artifacts are deleted when they pass the retention window; deleting a project deletes its runs, tests and artifacts.
Self-hosting
Running Vera yourself keeps everything on your own infrastructure. Two features are then available that are deliberately not offered on Vera Cloud, because they read the server's own filesystem:
- source-directory auto-configuration
- source-directory rule discovery
Both refuse to run on any network-reachable deployment, including a self-hosted one bound to a public interface. This is enforced in code, not by convention.
What Vera never does
- Sell or share your data with third parties.
- Read repositories you have not connected.
- Execute commands on your machine without your consent. Project setup actions of
type
commandrun on an agent only when the machine's operator setsVERA_ALLOW_SETUP_COMMANDS=trueand the token was minted with thesetup-commandscapability. Either one withheld means they do not run, and the run reports them as skipped.
Questions
Anything not covered here, or a specific requirement to check against: use Send feedback in the dashboard sidebar.