It tests your app. Here's how we treat it.

SuperGorilla connects as a GitHub App with access scoped to what a run needs: reading the change it’s testing and posting the report back to the pull request. The exact permission list is shown on the GitHub consent screen when you install, and we walk through each scope during onboarding.

Guardrails are hard limits you set in plain English: pages the agents stay out of, actions they never take, data they never touch. They bound every run, every time, and sit on top of the isolation the runs already execute in.

The agent signs in to your app with credentials you provide, stored encrypted. We recommend dedicated test accounts over real ones (seeded users in a test-mode environment) and help you set those up when you join.

Video and screenshots exist so you can see what happened; they belong to you. They’re retained for your team’s use and can be purged on request.

SuperGorilla learns your app across runs (conventions, gotchas, what broke before) at the organisation, project, repository, branch and pull-request level. What exactly is stored, for how long, and the controls you have over it are covered during onboarding, where we’ll answer anything about it directly.

Testing runs on frontier models, and you choose which. On the Enterprise plan you can bring your own API key, routing model traffic through your own provider account under your own agreement with the provider rather than ours.

We’re in open beta and we won’t claim certifications we don’t hold yet. If your evaluation needs specific answers (data residency, a questionnaire, a DPA), ask, and you’ll get a direct answer from an engineer.

Found something? support@supergorilla.ai reaches the team directly. We read everything and reply.