1. The Company
- Legal entity
- LambdaTest Inc. d/b/a TestMu, Privately held and backed by institutional investors.
- Headquarters
- 1390 Market Street, Suite 200, San Francisco, CA 94102, United States.
- Brand
- LambdaTest became TestMu AI on January 12, 2026. The legal entity is unchanged, as are existing contracts, certifications and sub-processor commitments.
- Operations
- Headquartered in San Francisco with principal operations in the United States, India and the United Arab Emirates.
- Oversight
- Board of Directors, which provides strategic oversight and counsel to Executive Leadership.
- Highest management body
- Executive Leadership, chaired by the Co-Founder & Chief Executive Officer.
2. Governance Principles
| Principle | What it means in practice |
|---|---|
| Integrity | Business is conducted lawfully and fairly everywhere we operate, with zero tolerance for bribery, corruption, discrimination, harassment and retaliation: every substantiated breach is acted on. |
| Accountability | Each policy has an executive owner, each control in scope has an operator, and each AI system within the AI management system has a named owner. Authority to approve, release, halt and accept risk is written down. |
| Transparency | Policies, principles, certifications and relevant assurance information are made available to stakeholders. Customers are notified of material changes in accordance with contractual commitments, subject to legal, security, confidentiality and regulatory limits. |
| Risk-informed decisions | One enterprise risk lifecycle, one rating scale and a stated risk appetite for each category guide decisions. Risks are escalated, treated or formally accepted by the appropriate authority, with residual risk documented and reviewed. |
| Responsible AI by design | Human oversight, fairness, transparency, security, privacy and accountability are conditions of release for each AI feature and agent within the AI management system. |
| Continual improvement | Audits, incidents, customer assessments and regulatory change feed a corrective-action process with owners and target dates. |
3. Governance Structure
Direction flows from Executive Leadership to the Information Security & Compliance Steering Committee (ISCSC), which oversees the management systems for security, privacy and AI and provides governance oversight of compliance and conduct. Designated officers operate those systems. The POSH Internal Committee in India handles complaints within its statutory jurisdiction (section 4.4). The Governance, Risk & Compliance function turns decisions into controls inside every team. Internal audit and external auditors test that the system works as described.
3.1 Executive Leadership
The Board of Directors provides strategic oversight and counsel to Executive Leadership; executive authority and accountability for the Company's governance rest with the Chief Executive Officer. Executive Leadership is the highest management body. It sets strategy and risk appetite, approves charters, policies and the scope of the management systems, reviews enterprise risk, governance, AI, security, privacy and environmental, social and governance considerations quarterly, and holds sole authority to accept Critical risks. It is chaired by the Chief Executive Officer and comprises the Company's senior executives.
3.2 Information Security & Compliance Steering Committee (ISCSC)
The ISCSC is the standing oversight committee for the information security, privacy, compliance and AI management systems, and for compliance and conduct. It is chaired by the Chief Executive Officer and operates under an approved charter. It meets quarterly, and whenever a significant change, risk or incident requires it, and conducts a formal management review of each management system at least annually. It reviews risks, incidents, audit findings, policy exceptions and management-system performance. It also reviews policies and amendments for approval by the Chief Executive Officer on behalf of Executive Leadership, and reviews risk-treatment plans and residual-risk decisions with Executive Leadership. Decisions and actions are recorded and tracked to closure.
In its conduct and integrity role, the ISCSC oversees the Code of Business Conduct & Ethics, the Anti-Bribery and Anti-Corruption Statement and the Whistleblower Policy. It oversees how reports and investigations are handled, approves high-risk third-party engagements and policy exceptions, and reports material matters to Executive Leadership. Investigations are conducted independently of the business area concerned. Matters involving members of Executive Leadership are investigated independently of management and overseen by the ISCSC, with the outcome reported to Executive Leadership.
3.3 AI Governance
The ISCSC acts as the AI Governance Committee. When sitting on AI matters, the ISCSC exercises the AI Governance Committee's functions. It:
- reviews AI risk and impact assessments prepared by the AI Risk Officer;
- considers AI-specific issues, exceptions and interested-party requirements;
- maintains the AI management system records under document control; and
- holds the authority to require additional testing or approval before deployment and to withhold, restrict, roll back or withdraw the release of an AI system.
Residual AI risk is accepted at the authority level set out in section 7.
3.4 POSH Internal Committee
A statutory Internal Committee is constituted in India under the Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 ("the POSH Act"), including an external member. It receives, investigates and determines complaints of sexual harassment within the statutory timelines, independently of the management structure, and reports annually as required by law. Complaints within the Internal Committee's statutory jurisdiction are handled by the Committee under the Prevention of Sexual Harassment (POSH) Statement; all other complaints are handled under the Global Anti-Harassment & Respectful Workplace Policy. Its constitution and procedure are described in the Prevention of Sexual Harassment (POSH) Statement.
3.5 Officers
| Officer | Authority and responsibility |
|---|---|
| Chief Financial Officer | Owns financial controls, the integrity of financial reporting, and financial and liquidity risk. |
| Data Protection Officer (DPO) | Owns the privacy management system, supervises data-subject rights handling, advises on impact assessments and is the contact point for supervisory authorities. |
| AI Risk Officer (AIRO) | Owns AI risk and impact assessment across the AI lifecycle, and ensures that each AI risk has an owner and a treatment plan. May require additional testing, human oversight or approval before an AI system is deployed or continues in operation. May recommend restriction, rollback, suspension or withdrawal of an AI capability to the ISCSC, and escalates significant or unacceptable AI risk to the ISCSC and Executive Leadership under the AI management system. |
| Information Security Officer | Owns the information security management system, the control environment and security incident response. |
| Head of Legal | Owns the policy framework, contractual governance and regulatory engagement, and advises on reports received through the ethics and whistleblower channel. |
| Human Resources | Owns the people policies, operates the ethics and whistleblower channel, conducts or commissions investigations and reports outcomes and trends to the ISCSC. |
| Governance, Risk & Compliance function | Owns the policy lifecycle, maintains the enterprise risk profile, tracks compliance obligations, and coordinates internal audit, audit readiness, evidence management and customer assurance across every team, in coordination with departmental heads. |
4. Decision Rights and Escalation
| Decision | Recommended by | Approved by |
|---|---|---|
| Strategy, risk appetite, management-system scope | Members of Executive Leadership | Executive Leadership |
| Charters and policies | Policy owner with GRC, reviewed by the ISCSC | Chief Executive Officer, on behalf of Executive Leadership |
| Risk treatment and residual-risk acceptance (enterprise and management-system risk) | Risk owner with GRC | Treatment plans for Critical risks are approved by Executive Leadership; for High risks by the ISCSC; for Moderate and Low risks by the risk owner's functional head with Governance, Risk & Compliance concurrence. Residual risk is accepted by the risk owner for Low and Moderate risks, by the ISCSC for High risks and by Executive Leadership for Critical risks. |
| Policy exception | Requesting function | ISCSC, time-bound and recorded |
| Release, restriction or withdrawal of an AI system | AI System Owner, with the AI Risk Officer | ISCSC, with residual risk accepted at the authority level set out in section 7 |
| High-risk third-party engagement (under our supplier risk-management process; suppliers that process customer personal data on TestMu's behalf are recorded in our published sub-processor list) | Procurement with GRC | ISCSC |
| Conduct investigation outcome | Investigating function | ISCSC, with Executive Leadership for senior matters |
5. Policy Framework
The Company operates a three-tier document hierarchy. Charters and management-system manuals set mandate and scope, policies set mandatory requirements, and procedures, standards and SOPs set out how those requirements are met. Each document carries a document identifier, a version number, an owner and an approver, and is held in the controlled document repository.
Policies are reviewed at least annually and whenever law, corporate structure, business model or risk profile changes materially. New and revised policies are recommended by the owner with the GRC function, reviewed by the ISCSC, approved by the Chief Executive Officer on behalf of Executive Leadership and communicated to those affected; employees acknowledge the Code of Business Conduct & Ethics and the policies applicable to their role on joining and annually thereafter.
6. Risk Management
Enterprise risk is managed under the Enterprise Risk Management Framework, which establishes a single risk lifecycle, a common rating scale, a stated appetite for each risk category and defined acceptance authorities. Domain methodologies (information security risk assessment under the information security management system, privacy risk and impact assessment under the privacy management system, AI risk and impact assessment under the AI management system, and third-party risk assessment) feed the enterprise risk profile. The enterprise risk profile is reviewed by the ISCSC and by Executive Leadership at least quarterly. Within the certified management systems, the domain methodologies govern risk assessment and treatment. Acceptance criteria and treatment thresholds are defined in the Company's management-system manuals. Treatment plans for Critical risks are approved by Executive Leadership; for High risks by the ISCSC; for Moderate and Low risks by the risk owner's functional head with Governance, Risk & Compliance concurrence. Residual risk is accepted by the risk owner for Low and Moderate risks, by the ISCSC for High risks and by Executive Leadership for Critical risks. The AI management system applies the equivalent process to AI risk and impact assessments.
7. Assurance
| Layer | What it covers |
|---|---|
| Governance review | Quarterly review by the ISCSC of risks, incidents, audit findings, policy exceptions and management-system performance, as described in section 4.2. |
| Management review | Formal review of each management system at least annually against objectives, performance data, audit results, incidents and improvement actions. |
| Internal audit | Audits at planned intervals, at least annually, covering the information security, privacy and AI management systems, with findings graded, owned and tracked to closure. |
| External certification | ISO/IEC 27001, ISO/IEC 27017 and ISO/IEC 27701 certification maintained through surveillance and recertification audits. The AI management system is aligned with ISO/IEC 42001; certification in progress. |
| Independent examination | SOC 2 Type II examination conducted annually by an independent auditor. |
| Customer assessment | Customer security, privacy and environmental, social and governance assessments, answered through the Trust Center and the Trust team. |
8. Transparency and Disclosure
The Company publishes its governance structure, principles and policy inventory on the Corporate Governance page of its website. It makes certificates, examination reports and supporting policies available through the Compliance Center. Aggregate outcomes are reported to Executive Leadership and may be made available to customers on request under confidentiality. Material changes affecting customers, including changes to sub-processors, security posture and AI terms are notified in accordance with contractual commitments.
Concerns and questions may be raised through any of the following channels:
| Channel | Who may use it | Address |
|---|---|---|
| Ethics and whistleblower channel | Anyone, inside or outside the Company, including employees, contractors, customers, suppliers and partners. Reports may be made anonymously where local law permits. Reports may be made anonymously by email. | whistleblower@testmuai.com |
| Human Resources | Employees and consultants, for workplace matters | hr@testmuai.com |
| Customer, supplier and contractor matters | Service, contractual or relationship complaints and governance enquiries. Conduct concerns received here are routed to the ethics and whistleblower channel. | support@testmuai.com |
| Privacy and security | Data protection requests and the Data Protection Officer; security vulnerabilities and incidents | privacy@testmuai.com / security@testmuai.com |
Reports to the ethics and whistleblower channel are received by Human Resources, which may engage Legal, Governance, Risk & Compliance after verification of the claims. Reports are acknowledged normally within five business days where contact details are provided, assessed for severity and conflict of interest, investigated independently of the business area concerned, and closed with a recorded outcome and tracked corrective action. Serious matters and matters involving senior leadership are investigated independently of management and overseen by the ISCSC. Concerns about Human Resources or Executive Leadership are escalated to the ISCSC; concerns about the Chief Executive Officer are escalated to the Board of Directors. Nothing in this document prevents any person from reporting a concern to a government, regulatory or law-enforcement authority, and no confidentiality obligation owed to the Company restricts such a report.
9. Charter Ownership and Review
This Charter is owned by the Legal function with the Governance, Risk & Compliance function. It is reviewed at least annually and whenever the governance structure changes. It is reviewed by the ISCSC and approved by the Chief Executive Officer on behalf of Executive Leadership.