How it runs
What actually happens when you start a run, where your data lives, and how keys and uploads are handled.
What runs where
Reads
A read runs inside the API and finishes in seconds. A few language-model calls appraise your variants, then the THYMOS choice model runs across a weighted population for the market you picked.
Site audits
Each audit is its own job, in its own container, with a real Chromium browser. Simulated visitors open your page or walk your flow, and each one's steps and reasoning are recorded. The job reports back and the API builds the report, with heatmap and journeys. Pages must be publicly reachable. Private and internal addresses are refused. For pages behind a login, give the audit a dedicated test account, not a real one.
Studies, creative tests and post simulations
These run as queued background jobs. Language models produce each person's reaction, and the results are combined into verdicts, segment differences, objections and quotes. Video is split into scenes first.
Timing
Reads take seconds. Everything else is asynchronous: you get an id straight away and the result fills in later. Studies and audits usually take minutes and can take up to about 40. If a job dies, a sweep marks it failed and the reserved capacity is returned.
What models we use
Thesia uses third-party language models for appraisal, wording and report writing, and our own THYMOS model for the choices described in Simulated audiences and THYMOS. The model behind a given step can change as we test new ones.
Where your data lives
The API, database, file storage and audit jobs run on Microsoft Azure in the EU. Sign-in runs on Clerk, payments on Stripe, and the website on Vercel. The full list of processors and their regions, including AI infrastructure providers, is in the privacy policy.
Accounts and access
- Everything you create belongs to a workspace. Members see the workspaces they belong to, and organization owners and admins can open all of theirs.
- Share links are off until you create one. A link can have an expiry date and a password.
- API keys are shown once and stored only as a keyed hash. Revoking one takes effect on the next request.
- An API key acts as the person who made it. It cannot manage keys, members, billing or data deletion.
- Research file uploads are virus-scanned before use.
For developers
- API and MCP setup, for Claude Code, Cursor and other agents.
- API reference, plus the raw OpenAPI file.
- Agent quickstart, written to be followed by an agent.
More on our controls is on the security page and in the data processing agreement.