Panto AI

GDPR overview

Panto AI displays a GDPR and CCPA compliance badge on its security page and states that it acts as a data processor while customers retain ownership of their data. It is ISO/IEC 27001:2022 certified, has undergone a CERT-IN code audit by an empanelled auditor, and describes a SOC 2 Type 2 attestation as still in progress. Listed technical measures include FIPS-compliant AES-256 encryption at rest including backups, TLS in transit, mandatory MFA for administrative access, Azure RBAC, SAML and OAuth SSO through Microsoft Entra ID, and an incident response plan aligned with NIST SP 800-61. Data localization requests are accepted. The claim rests entirely on that single page, however: no privacy policy, terms of service or data processing agreement is published, no data protection officer or Article 27 EU representative is named, and no postal address appears anywhere on the site.

Who owns the data?

The only document addressing data governance is the security page; no terms of service and no privacy policy are published. It states that customers retain ownership of their data and that Panto AI positions itself as a data processor acting on their behalf. Each customer sits in an isolated tenant — separate storage containers or databases, no shared database — and can consult its own audit logs from the dashboard, showing who accessed which report and when. Customers are responsible for uploading only authorized builds and for keeping secrets out of them. The publisher warns that any uploaded data or APK is also visible to its support team during troubleshooting.

Reuse rights

The security page lists what the platform ingests: application artefacts (customer APKs, build metadata such as version, name and package), test execution data (run identifiers, configurations, device details, steps and results), application, device, network, crash and session logs and metrics (CPU, memory, battery, temperature, frame rate), media captures (screenshots, screen recordings and video streams when enabled), workflow context (prompts, responses, environment variables, agent memory and state), integration and account metadata including secrets, configuration, team, workspace, identity and roles, and aggregated historical reports. The stated purpose is narrow: run tests on real devices, debug, and produce reports and analytics on demand. The publisher declares it never mines this material or uses it to train general AI models, and never shares it outside the scope of testing; AI assistants work on an ephemeral basis, with the input and output of each session or run isolated rather than aggregated for learning. External device farms receive the APK and the test instructions over encrypted channels as service providers under mutual confidentiality agreements, with no right to keep or reuse builds beyond execution — but they are not named publicly. No training opt-out is documented, which is consistent with a publisher that claims not to train at all.

Data retention & training

Hosting summary

Panto AI hosts its platform on Microsoft Azure. Data is stored in the Azure region selected by the customer, and the publisher states that it complies with data localization requests and can keep data within specified geographic boundaries when required. No country and no Azure region is named anywhere on the site, which is why the hosting country and region fields remain empty. Tenants are isolated through Azure Active Directory and separate subscriptions, with separate storage containers or databases and no shared database. Encryption is FIPS-compliant AES-256 at rest, backups included, and TLS/HTTPS in transit. A shared responsibility model is stated explicitly: Microsoft secures the infrastructure, Panto AI secures its own usage and software. Test execution partly leaves that perimeter, since unnamed external device farms receive the APK and the test instructions over encrypted channels. Enterprise customers can obtain a dedicated or on-premise deployment on Azure, AWS, GCP or a custom cloud. Note that the site's resolved IP address (76.76.21.21, Amazon AS16509, an anycast node) belongs to the marketing site's CDN and says nothing about where the platform itself runs.