- 01 Governance framework
- Board oversight, Executive Leadership, one steering committee and three specialized pillars.
- 02 The Standards We Live By
- The policies and frameworks that codify how we operate.
- 03 Ethics and speak-up
- Standards of conduct, confidential reporting and disclosed outcomes.
- 04 Risk and controls
- One enterprise risk framework, a stated appetite per category, three lines of accountability.
- 05 Responsible AI
- Accountability, lifecycle management and risk management for every AI system.
- 06 Global compliance
- One global standard, with jurisdiction-specific provisions where local law requires more.
01 · Framework
How TestMu AI Is Governed
Clear accountability starts at the top. Our Board of Directors provides oversight, Executive Leadership sets direction, and a steering committee chaired by our Chief Executive Officer keeps security, privacy, compliance, AI and enterprise risk under one roof. Three focused pillars, AI governance, ESG governance and enterprise risk, carry that direction into everyday decisions, and our Governance, Risk & Compliance team works alongside every function to turn commitments into controls that operate inside each team. Independent auditors then confirm that the system works the way we say it does. Roles, decision rights and escalation paths are written down in our governance framework, published below.
Governance Structure
- Oversight
- Board of DirectorsProvides strategic oversight and counsel to Executive Leadership. Executive authority and accountability for the company's governance rest with the Chief Executive Officer.
- Direction
- Executive LeadershipSets strategy and risk appetite, approves key policies, allocates resources and holds ultimate accountability. Chaired by the Co-Founder & Chief Executive Officer. Reviews enterprise risk, governance, AI, security, privacy and ESG performance quarterly, and holds sole authority to accept the most significant risks.
- Steering
- Information Security & Compliance Steering Committee (ISCSC)Governs information security, privacy, compliance, AI and enterprise risk under an approved charter. Chaired by the Chief Executive Officer; the Information Security Officer, Data Protection Officer and AI Risk Officer report into it. Meets quarterly, and whenever a significant incident, change or risk requires it. Acts as the AI Governance Committee when sitting on AI matters.
- Pillars
- AI Governance · ESG Governance · Enterprise RiskAI Governance for the responsible design, deployment and monitoring of AI systems, supported by a designated AI Risk Officer; ESG Governance for environmental, social and governance commitments; Enterprise Risk across nine risk categories under the Enterprise Risk Management Framework.
- Officers
- Designated officersThe Information Security Officer owns the information security management system and incident response; the Data Protection Officer owns the privacy management system and is the contact point for supervisory authorities; the AI Risk Officer owns AI risk and impact assessment across the AI lifecycle; the Chief Financial Officer owns financial controls and financial risk; the Head of Legal owns the policy framework, contractual governance and regulatory engagement; Human Resources owns the people policies and operates the ethics and whistleblower channel.
- Coordination
- Governance, Risk & ComplianceOwns the policy lifecycle, monitors compliance, coordinates internal audit, customer assurance and ESG reporting and drives continuous improvement with departmental heads across Engineering, Product, IT, People, Legal, Finance, Customer Success and Administration.
- Assurance
- Internal audit and independent assessmentInternal audit at planned intervals and an annual management review, together with certification audits, SOC 2 Type II examination and third-party assessments. Findings are graded, owned and tracked to closure.
Ethical business. We conduct business with integrity, accountability, fairness and respect for the law in every jurisdiction in which we operate.
Transparency and accountability. Clear governance structures, defined responsibilities and measurable objectives. Every policy has an executive owner and every control an operator.
Risk-informed decisions. One risk lifecycle and one rating scale, so that leadership decides with a documented view of impact and likelihood under an explicit appetite for each risk category.
Responsible AI by design. Human oversight, fairness, transparency, security, privacy and accountability are conditions of release for every AI feature and agent, not qualities assessed after the fact.
Continual improvement. Audits, assurance testing (penetration tests, vulnerability assessments and business-continuity and disaster-recovery exercises), customer assessments and regulatory change feed a corrective-action process with owners and target dates, tracked to closure by Governance, Risk & Compliance.
Governance Calendar
| Cadence | Activity |
|---|---|
| Quarterly | Executive Leadership review of enterprise risk, governance, AI, security, privacy and ESG. ISCSC meeting: Enterprise Risk Profile, incidents, audit findings, policy exceptions and treatment progress. AI risk records, AI incidents and hard-stop conditions reported by the AI Risk Officer. |
| Annually | Management review of each management system. Internal audit program. SOC 2 Type II examination. Policy review and re-approval. Code of Business Conduct & Ethics acknowledgment and training. Business continuity and disaster-recovery exercise. Risk appetite review. ESG data review and reporting. |
| Per certification cycle | Surveillance and recertification audits for ISO/IEC 27001, 27017 and 27701 by an accredited certification body. ISO/IEC 42001 certification audit on completion of implementation. |
| As required | ISCSC convened for a significant incident, change or risk. Risk re-assessment after any material incident, audit finding, change in law or release of a new AI system. Customer, regulatory and supplier assessments. |
Independent Assurance
Governance claims on this page are tested by parties outside the business. Certificates, audit reports and control descriptions are available in our Compliance Center at https://trust.testmuai.com/.
| Assurance | Scope | Status and cadence |
|---|---|---|
| ISO/IEC 27001 | Information security management system covering the platform, cloud infrastructure and supporting operations | Certified; annual surveillance and three-year recertification by an accredited body |
| ISO/IEC 27017 | Cloud-specific information security controls | Certified; assessed with ISO/IEC 27001 |
| ISO/IEC 27701 | Privacy information management system, as controller and processor | Certified; assessed with ISO/IEC 27001 |
| SOC 2 Type II | Security, availability, processing integrity, confidentiality and privacy, with HIPAA Security Rule mapping | Examined annually by an independent auditor |
| ISO/IEC 42001 | AI management system covering the AI agents, models and AI-enabled features we build, integrate and rely upon | Aligned; certification in progress |
| ISO 37001 principles | Anti-bribery management framework | Aligned; overseen by the ISCSC |
| Internal audit | All management systems, the Enterprise Risk Management Framework and key controls | At planned intervals, at least annually; findings tracked to closure |
02 · The Standards We Live By
Our Policies and Frameworks
Our governance framework is written down in a set of policies and frameworks approved by Executive Leadership and maintained by Governance, Risk & Compliance. Together they set the standards of conduct, accountability and control that apply across TestMu AI and to every third party we work with. Each one is published here in full, so customers, partners and suppliers can read exactly what we hold ourselves to.
Every policy and framework is reviewed at least once a year, and sooner whenever law, our corporate structure or our operations change materially. Each is recommended by its owner together with Governance, Risk & Compliance, reviewed by the ISCSC and approved by the Chief Executive Officer on behalf of Executive Leadership, and carries its version number. Charters and management-system manuals set mandate and scope; policies set the mandatory requirements; procedures and standards describe how those requirements are met.
Governance and Risk
- Corporate Governance Charter
- Who holds authority, what each governance body and officer is responsible for, decision rights and escalation, and how the system is assured.Read the Corporate Governance Charter
- Enterprise Risk Management Framework
- How strategic, operational and technology, financial, AI, security, privacy, legal and compliance, third-party and continuity risks are identified, assessed, treated and reported.Read the Enterprise Risk Management Framework
Ethics and Conduct
- Code of Business Conduct & Ethics
- The standard of conduct expected of everyone acting on our behalf: conflicts of interest, gifts and hospitality, confidentiality, fair competition and speaking up.Read the Code of Business Conduct & Ethics
- Anti-Bribery and Anti-Corruption Statement
- Zero tolerance for bribes, kickbacks and facilitation payments; what we ask of third parties; how to report; the undertaking third parties sign.Read the Anti-Bribery and Anti-Corruption Statement
- Whistleblower Policy
- Confidential reporting channels, how reports are handled and investigated, and protection from retaliation for anyone reporting in good faith.Read the Whistleblower Policy
People and Human Rights
- Global Anti-Harassment & Respectful Workplace Policy
- Prohibits harassment, discrimination, bullying and retaliation, and defines how concerns are raised, investigated and resolved.Read the Global Anti-Harassment & Respectful Workplace Policy
- Prevention of Sexual Harassment (POSH) Statement
- Our zero-tolerance stance and the statutory complaint process we maintain in India, applied to the same standard as our global policy.Read the Prevention of Sexual Harassment (POSH) Statement
- Global Diversity, Equity & Inclusion Policy
- Inclusive hiring, accessibility and neurodiversity support, and equitable practices across the employee lifecycle.Read the Global Diversity, Equity & Inclusion Policy
- Human Rights Statement
- Alignment with the UN Guiding Principles and the ILO core conventions, including the prohibition of child and forced labor in our operations and supply chain, and our health and safety commitment.Read the Human Rights Statement
Third Parties and Community
- Supplier Code of Conduct
- Labor and human rights, health and safety, environment, ethics, data protection, responsible AI use and verification for the companies we buy from.Read the Supplier Code of Conduct
03 · Ethics and speak-up
Business Ethics and Integrity
Integrity, transparency and ethical conduct form the foundation of our governance framework and the way we work every day. Each commitment below is supported by a published policy, an operating process, an oversight body and an outcome reported in our annual ESG Report.
| Commitment | How it operates | 2025 outcome |
|---|---|---|
| Code of Business Conduct & Ethics | Binds all employees, contractors and partners acting on our behalf. Acknowledged on joining and annually, and reinforced through mandatory training. | Acknowledged and trained company-wide |
| Anti-bribery and anti-corruption | Prohibits bribes, kickbacks and facilitation payments, whether direct or through third parties. Due diligence on partners, approval requirements for gifts and hospitality, and a signed undertaking from third parties where required. Framework aligned with the principles of ISO 37001. | Zero confirmed incidents |
| Speak up without fear of retaliation | Confidential channels, anonymous where local law permits. Reports are investigated independently of the business area concerned; serious or senior-level matters are overseen by the Steering Committee. | Formal policy in operation |
| A respectful and safe workplace | Global anti-harassment, inclusion and human rights standards in every jurisdiction, applied through local procedures where employment law requires them, and a health and safety commitment under the Human Rights Statement. | Zero substantiated harassment complaints · zero reportable safety incidents |
Anti-bribery and anti-corruption in practice. We do not pay bribes, we do not accept them, and we do not allow anyone acting for us to do so. Competitive pressure, customer demand, local custom and commercial incentive are never a justification, and no one at TestMu AI is penalized for losing business because they refused to act improperly. Gifts, meals and hospitality must be modest, infrequent, transparent and recorded, and are never exchanged while a contract, renewal, tender or approval is under consideration; cash and cash equivalents are never acceptable in either direction. Third parties that act for us accept anti-corruption terms in their agreements, including a right of audit and termination for breach, cascade the standard to their own sub-contractors, and notify us of any investigation or change of ownership involving a government official.
Raising a Concern
Ethics and whistleblowing. Suspected violations of our Code, bribery, fraud, harassment or retaliation, from anyone inside or outside the company. Reports are acknowledged, assessed for severity and conflict of interest, investigated independently, and closed with recorded outcomes and tracked corrective action. Reports may be made anonymously by email. whistleblower@testmuai.com
Customers, vendors and contractors. Service, contractual or relationship complaints, and enquiries about governance or policies. Conduct matters received here are routed to the whistleblower process. support@testmuai.com
Privacy and security. Data protection requests and our Data Protection Officer; vulnerability reports. privacy@testmuai.com · security@testmuai.com
What happens next. Reports are acknowledged, normally within five business days where contact details are provided; assessed for severity, scope and conflict of interest and assigned to a team independent of the business area concerned; investigated, with serious matters and matters involving senior leadership investigated independently of management and overseen by the Steering Committee, concerns about Executive Leadership escalated to the Steering Committee and concerns about the Chief Executive Officer to the Board of Directors; and concluded with findings and corrective action tracked to completion and, so far as confidentiality permits, the outcome communicated to the reporter, normally within three months of acknowledgment. Nothing in our policies prevents any person from reporting a concern to a government, regulatory or law-enforcement authority.
04 · Risk and controls
Enterprise Risk Management and Internal Control
Effective risk management enables TestMu AI to pursue its strategic objectives while protecting customers, employees, investors and other stakeholders. Our Enterprise Risk Management Framework, aligned with ISO 31000, COSO Enterprise Risk Management and the IIA Three Lines Model, brings strategic, operational and technology, financial, Responsible AI, information security, privacy, legal and compliance, third-party and business-continuity risk into one governance process with one rating scale.
Executive Leadership sets an explicit risk appetite for each category: very low for security, privacy and legal and compliance; low for artificial intelligence, operational and technology, financial, third-party and continuity risk; and moderate for strategic risk taken in pursuit of AI-native product leadership. Every material risk has a named owner, is assessed inherently and residually, is treated at an approval level that rises with its rating, and is re-assessed at least annually and whenever a material change, incident, audit finding or regulatory development alters the profile. The consolidated Enterprise Risk Profile is reviewed quarterly by the Steering Committee and Executive Leadership, and a newly identified critical risk, a risk moving outside tolerance or a major incident is escalated immediately.
Accountability follows the Three Lines Model: business functions operate the controls embedded in their processes; Security, Privacy, GRC, Legal and Finance set policy, monitor key risk indicators and provide challenge; and internal audit and independent external auditors validate that the framework operates as designed, with findings reported to Executive Leadership and tracked to closure.
The full methodology, including risk categories and criteria, the rating scale, treatment options, acceptance authority and escalation thresholds, is set out in the Enterprise Risk Management Framework. Read the Enterprise Risk Management Framework
Third-Party Governance
Suppliers are risk-tiered before engagement and, where they store, process or can access company information, assessed across security, privacy, compliance, operational resilience and ethics. Obligations are incorporated into contract, sub-processors handling personal data are published and changes notified in advance, and oversight continues for the life of the relationship through monitoring, reassessment and, where necessary, remediation or exit.
Compliance with the Supplier Code of Conduct is a condition of doing business with TestMu AI and is incorporated by reference into our supplier agreements. It requires legal compliance in every jurisdiction; labor and human rights standards consistent with the ILO core conventions; a safe working environment; management of environmental impact; anti-bribery, conflict-of-interest and fair-competition obligations; protection of confidential and personal information with incident notification within contractual timeframes; disclosure of AI use, human oversight of AI-assisted decisions and no use of TestMu AI or customer data to train models except as permitted by agreement; and respect for intellectual property. High-risk engagements are approved by the Steering Committee. Providers of AI and technology services carry the same Responsible AI obligations we hold ourselves to.
05 · Responsible AI
AI Governance, Lifecycle and Risk Management
Responsible AI is central to our technology strategy and governance framework. AI systems are governed through structured oversight, documented risk and impact assessment, human review and continuous performance monitoring across the whole lifecycle. Our AI management system is aligned with ISO/IEC 42001, with certification in progress, and references the NIST AI Risk Management Framework, the OECD AI Principles and the EU AI Act.
Accountability. Executive Leadership approves the scope of the AI management system, the AI Policy and the AI risk appetite. The Steering Committee oversees the system in operation, acting as the AI Governance Committee, and a designated AI Risk Officer runs it day to day. No AI system reaches production without a named owner.
AI lifecycle management. Every AI system, and every material change to one, passes through a controlled lifecycle (design, development, validation, deployment, monitoring and retirement), with defined acceptance criteria, human review and a rollback path at each stage. Suppliers and AI providers carry the same Responsible AI obligations.
AI risk management. AI, security and privacy risks are assessed under one methodology, with treatment plans and residual risk approved before release. The AI Risk Officer may require additional testing or approval before deployment and recommend restriction, rollback or withdrawal. AI-specific incidents are logged, triaged, remediated and reviewed for lessons learned.
How the AI Management System Operates
| Element | What it covers |
|---|---|
| Scope | The AI agents, models and AI-enabled features TestMu AI builds, integrates or relies upon, including third-party models and LLM providers, across their full lifecycle. |
| Risk and impact assessment | Each AI system is assessed before release and at material change for accuracy and reliability of outputs, bias and fairness, transparency and explainability, adequacy of human oversight, AI security including prompt injection and adversarial manipulation, data quality and provenance, dependence on third-party models, foreseeable misuse, intellectual-property and confidentiality exposure, and impact on individuals, groups and society. |
| Release gates | Residual risk accepted at the authority level set by the Enterprise Risk Management Framework; the AI Risk Officer may require additional testing, human oversight or approval before deployment; the Steering Committee approves release, restriction or withdrawal. Defined hard-stop conditions, such as a prohibited use or an unresolved critical control failure, cannot be overridden by internal risk acceptance. |
| Monitoring and incidents | Performance, drift and misuse monitored in production; AI incidents handled under the incident process with root-cause review; AI risk records, incidents and hard-stop conditions reported to the Steering Committee quarterly. |
| Customer data | TestMu AI does not use customer data to train models except as permitted by the applicable agreement. |
| Suppliers and AI providers | Providers of models, AI tooling and AI-enabled services disclose their use of AI, maintain human oversight and accountability, mitigate bias and unsafe behavior, and do not retain or train on our inputs without authorization. |
| People | Required Responsible AI training for all employees; role-based training for AI system owners and reviewers; misuse of AI is a reportable concern under the Whistleblower Policy. |
Our Responsible AI Principles (human oversight and accountability, fairness and non-discrimination, transparency and explainability, privacy and security by design, continuous monitoring and risk-based governance) are published in the Compliance Center at https://trust.testmuai.com/.
06 · Global compliance
Global Compliance
TestMu AI operates from the United States, India and the United Arab Emirates and serves customers in 132 countries, many of them in regulated industries. Our policies set one global standard that applies everywhere we operate, and carry jurisdiction-specific provisions where local law requires more. New obligations are added as provisions rather than rewrites, so the global standard stays stable and local requirements stay visible. Where a national law and an international standard differ, we follow the higher standard. Compliance obligations are tracked and reviewed by Legal and Governance, Risk & Compliance, monitored through regulatory horizon scanning across the jurisdictions in which we operate and sell, and tested through internal audit.
07 · Corporate profile
The Company Being Governed
- Legal entity
- LambdaTest Inc. d/b/a TestMu
- Ownership
- Privately held; backed by institutional investors
- Oversight
- Board of Directors; executive authority rests with the Chief Executive Officer
- Highest management body
- Executive Leadership, chaired by the Co-Founder & Chief Executive Officer
- Headquarters
- 1390 Market Street, Suite 200, San Francisco, CA 94102, United States
- Operations
- United States, India and the United Arab Emirates
- Brand
- LambdaTest became TestMu AI on January 12, 2026. The legal entity, team and infrastructure are unchanged; existing contracts, certifications and accounts remain valid.