1. Our core commitments
- We do not train AI models on your data. Customer Data (reports, packets, screenshots, replays and captured details) is never used to train or fine-tune Rebase’s or any third party’s models.
- Built-in AI is disclosed and controllable. AI-assisted triage is included in every plan with no separate allowance (see §3); it uses the AI provider listed on our Subprocessors page. A workspace owner can turn off new triage and AI search in workspace settings. Connecting an external agent is always your action.
- You stay in control. You decide which agents and integrations to connect and which reports they can read.
2. Connecting your own AI agents (MCP)
Rebase gives read-only access to reports through the Model Context Protocol (MCP), so an AI agent you connect, such as Claude or Cursor, can read a report and help draft a fix. When you connect an agent:
- The agent and its underlying model provider are chosen and controlled by you;
- The reports you authorize are shared with that agent under the provider’s terms;
- Beyond the built-in triage described in §3, Rebase does not send your data to model providers on your behalf.
Because the model provider is your choice, that provider acts as your subprocessor for the data you route to it, not Rebase’s. Review your provider’s data and retention policies before connecting.
3. AI-assisted features within Rebase
AI-assisted triage is part of the service and is on by default for every workspace, including during the trial. It summarizes each report, suggests a type, priority and title, finds related reports, and may ask the person who reported one follow-up question they can skip. It uses only a minimized, scrubbed slice of the report’s text; screenshots and replays are never sent, and sharing a packet does not start AI. Triage output is an aid with a human in the loop, and is not used to make decisions producing legal or similarly significant effects without human review. The third-party model provider powering it is listed on our Subprocessors page, does not train on your data. If you would rather not use AI at all, a workspace owner can turn it off in workspace settings.
4. Data minimization & masking
The same privacy protections that apply to capture apply to AI features: password, payment, one-time-code, phone and hidden fields are always masked, every other typed value is masked by default, customer-marked elements are masked, and secrets are scrubbed, before data is stored or shared. You remain responsible for configuring masking for sensitive fields on your site.
5. Accuracy
AI output can be incomplete or incorrect. Suggestions are aids, not professional advice, and should be reviewed by a person before you rely on them.
6. Changes & contact
We’ll update this policy as our AI features evolve. Questions? Email support@rebase.dev.