Ask seven things: what is sent, where it is processed, who else touches it, how long it is kept, whether it trains any model, how you delete it, and how you can verify all of that. Get each answer in the contract or a data processing addendum, not only on a sales call.
Why this is a data question first
An AI review tool reads source code, and source code often contains secrets, customer identifiers in test data, and details of how your systems are built. Once code leaves your network, you rely on the vendor's practices and contract. That is the same shape of risk as any processor relationship.
Where personal data is involved, the GDPR is specific about what a processor contract must contain. Article 28 requires, among other things, written authorisation for sub-processors, deletion or return of data when the service ends, and information and audit support for the controller. Those are good prompts even if GDPR does not apply to you.
The seven questions
| # | Question | What a good answer looks like |
|---|---|---|
| 1 | What exactly is sent: the diff, whole files, the repo, metadata? | A specific list, with an option to narrow it |
| 2 | Where is it processed, and in which regions? | Named regions, and a way to pin one |
| 3 | Which sub-processors, including the model provider, see it? | A named list and a change notice process |
| 4 | How long is it retained, and in which systems (logs, caches, backups)? | A number of days per system |
| 5 | Is it used to train or tune any model, yours or a third party's? | A plain no, in writing, or a clear opt out |
| 6 | How is it deleted on request and at contract end? | A process, a timeline, and confirmation |
| 7 | What can I audit or review independently? | Reports, access to logs, a right to ask |
Details people miss
Retention in logs. Prompts and responses often land in debug logs that live longer than the main store. Ask about them by name.
The model provider is a sub-processor. If the tool calls a hosted model, that provider receives your code. The sub-processor list should say so.
Training versus improvement. Some terms allow using "usage data" to improve services. Ask whether code or prompts count as usage data.
Telemetry. Even when code is not retained, file names, repo names and error messages can be.
Secrets. Ask whether the tool scans for secrets before sending and redacts them. Do not rely on this alone, since redaction misses unusual formats.
How to run the review
- Send the seven questions in writing before the trial starts.
- Compare answers with the published terms and privacy documents. Note any conflict.
- For the trial, use a repository with no regulated or customer data.
- Ask the security contact, not the sales contact, to confirm retention and training answers.
- Store the answers with your vendor record so a later review can see what you were told.
Related reading: what data should never go into an AI coding assistant and security questions for AI coding assistant vendors.
Quick check
Does a "we do not train on your data" line on a website settle it?
Not by itself. Check that the contract says the same thing, and ask about sub-processors, since the website may describe only the vendor's own behaviour.
What if the vendor will not answer in writing?
Treat that as an answer. Limit the trial to non-sensitive code or choose a deployment where code stays in your environment.
Safeguard offers SBOM and dependency scanning, and the free scan at gold.safeguard.sh/scan lets you watch a scanner work on a public repo before you share anything private.
Sources
Last reviewed: 19 October 2026.
