From 23d361d32638ef6ccd63fae2a90b3e4bebaab60a Mon Sep 17 00:00:00 2001 From: Andrew Goldis Date: Wed, 19 Aug 2026 23:32:18 -0700 Subject: [PATCH 1/2] docs: what AI features send and how org consent works MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The AI features send test data — errors, stack traces, the error-context snapshot, source snippets — to an LLM provider, and that now requires an organization admin's consent. Nothing documented what leaves the account or who controls it. Describes the payload, the default provider (OpenAI, overridable to any OpenAI-compatible endpoint in self-hosted deployments), that admins hold the org-wide switch, and that revoking fails in-flight requests but does not recall data already sent. Says plainly that test output is sent as captured: values a test logs into errors or console output are part of the payload. The PII guardrails in the codebase are not wired into the request path, so the page promises no filtering. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_014phZyEHhP699kRwV4GRhQ1 --- SUMMARY.md | 1 + ai/data-usage-and-consent.md | 68 ++++++++++++++++++++++++++++++++++++ ai/overview.md | 2 ++ 3 files changed, 71 insertions(+) create mode 100644 ai/data-usage-and-consent.md diff --git a/SUMMARY.md b/SUMMARY.md index fd99025..e48032b 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -60,6 +60,7 @@ ## AI * [Overview](ai/overview.md) +* [Data Usage and Consent](ai/data-usage-and-consent.md) * [MCP Server](ai/mcp-server.md) * [Agent Skill: Playwright Best Practices](ai/agent-skill-playwright-best-practices.md "Playwright Skill") * [IDE Extension](ai/ide-extension.md) diff --git a/ai/data-usage-and-consent.md b/ai/data-usage-and-consent.md new file mode 100644 index 0000000..e651f7b --- /dev/null +++ b/ai/data-usage-and-consent.md @@ -0,0 +1,68 @@ +--- +description: >- + What test data Currents sends to an AI provider, when it is sent, and how + organization admins grant or revoke consent +icon: shield-check +--- + +# AI Data Usage and Consent + +Currents' AI features work by sending part of your test data to a large-language-model provider. That only happens after an administrator of your organization consents to it. Until then, the AI features stay off for everyone in the organization. + +This page describes what is sent, when, and who controls it. + +## What is sent + +When an AI feature runs on a failed test, Currents sends the troubleshooting context it assembled for that test: + +* The error message, stack trace, and code frame from the failed attempt +* The **error-context snapshot** captured at the moment of failure: the page accessibility tree, console output, and network logs +* Source code snippets referenced by the stack trace +* Test, spec, and run identifiers, along with the test's title and file path +* Historical pass/fail and flakiness data for that test + +Nothing is sent on a schedule or in the background. A request is made only when someone opens an AI feature on a specific test, or when an automation you configured requests one. + +{% hint style="warning" %} +This data comes from your test run, and Currents sends it as captured. If your tests log credentials, tokens, customer records, or other sensitive values into errors, console output, or network logs, those values are part of what gets sent. + +Treat the consent decision as covering whatever your tests produce, and keep secrets out of test output regardless of whether AI features are enabled. +{% endhint %} + +## Where it is sent + +Currents sends the context to an LLM provider over an API call. The default provider is OpenAI; self-hosted and enterprise deployments can point Currents at a different OpenAI-compatible endpoint — an LLM gateway, Azure OpenAI, or another provider — via configuration. + +Your test data is not used to train models. Requests are made through the provider's API, which is covered by the provider's API data-handling terms rather than its consumer-product terms. + +## Who can grant consent + +Only **organization administrators** can change the consent setting. The decision applies to the entire organization: every project, every user, every AI entry point. + +Consent is off by default. A newly created organization has AI features disabled until an admin turns them on, except where the person creating the organization grants consent during signup. + +## Granting and revoking consent + +Go to **Organization Settings → AI usage consent** and use the toggle. + +The setting records who made the decision, when, and which version of the terms was shown at the time. That stamp appears under the toggle. + +### Revoking + +Revoking takes effect immediately: + +* AI features stop working for everyone in the organization +* AI requests already in flight fail rather than completing +* Data already sent to the provider is not recalled — revoking stops future requests + +Because in-flight work fails, the dashboard asks you to confirm before revoking. + +## Turning AI off without revoking consent + +Consent controls whether Currents *may* send data. If you want to keep consent in place but stop using a specific feature, disable that feature instead — consent by itself does not trigger any requests. + +## Related + +* [AI Overview](overview.md) — the AI features and entry points +* [Manage Team](../dashboard/administration/manage-team.md) — organization roles and who counts as an administrator +* [Service Agreement](https://currents.dev/tos) — the terms governing AI data use diff --git a/ai/overview.md b/ai/overview.md index f731a22..e99cafd 100644 --- a/ai/overview.md +++ b/ai/overview.md @@ -26,6 +26,8 @@ Currents post-processes test results on the server into a structured troubleshoo Every entry point below delivers this same context - they differ in where you are when you use them and how much of the loop is automated. +Sending that context to an AI provider requires your organization's consent, which an administrator grants once for the whole organization. See [Data Usage and Consent](data-usage-and-consent.md) for what is sent and how to grant or revoke it. + ## Entry points | Method | Where | Best for | From 3cd35ef788105f9575b18472ef3f67c1bac1129d Mon Sep 17 00:00:00 2001 From: Andrew Goldis Date: Thu, 20 Aug 2026 17:06:35 -0700 Subject: [PATCH 2/2] docs: describe the consent checkbox as it shipped The page said consent was off by default and granted during signup. What merged puts a ticked "Allow AI analysis" box on the org creation form, and the signup screen carries no consent UI at all. Clearing the box records nothing, which is a third state from refusing. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_014phZyEHhP699kRwV4GRhQ1 --- ai/data-usage-and-consent.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ai/data-usage-and-consent.md b/ai/data-usage-and-consent.md index e651f7b..a30a8b3 100644 --- a/ai/data-usage-and-consent.md +++ b/ai/data-usage-and-consent.md @@ -39,7 +39,7 @@ Your test data is not used to train models. Requests are made through the provid Only **organization administrators** can change the consent setting. The decision applies to the entire organization: every project, every user, every AI entry point. -Consent is off by default. A newly created organization has AI features disabled until an admin turns them on, except where the person creating the organization grants consent during signup. +The organization creation form offers **Allow AI analysis**, ticked by default. Leaving it ticked records the grant against the person creating the organization; clearing it records nothing at all, so the organization reads as never asked rather than as having refused, and its AI features stay off until an admin grants consent in settings. ## Granting and revoking consent