AI coding assistant privacy checklist

Coding assistants see your repository, your comments, and sometimes your secrets. Privacy review is not a vibe check or a marketing PDF; it is a short list of decisions your security and legal stakeholders can sign. Use this checklist alongside the AI tool comparison checklist and the Cursor vs Copilot vs Claude Code matrix.

This guide does not claim any vendor is “safe.” Defaults change. Verify current policy text on the date you buy.

1. Map what leaves the machine

Write down data paths for each candidate tool:

• Inline completions (current file / adjacent tabs)
• Chat with @repo or codebase indexing
• Agent mode that runs commands or opens PRs
• CI / bot accounts that clone private repos
• Telemetry (accept/reject events, prompts, stack traces)

If you cannot diagram the path, you cannot approve the tool.

2. Training and retention defaults

Ask in writing (and keep the reply):

• Is prompt/code used to train shared models by default?
• Is there an org-level opt-out or zero-retention mode?
• How long are prompts, completions, and embeddings stored?
• Who can access logs (support, model trainers, subprocessors)?

Prefer contracts and admin console screenshots over blog posts. Re-check after plan changes (individual → team → enterprise).

3. Secrets and sensitive files

Assume the model context will eventually see something it should not. Mitigate:

• Block .env, key files, and credential paths in ignore/allow lists
• Redact tokens in chat pastes; never paste production secrets “to debug”
• Rotate any key that appeared in a prompt window — treat it as exposed
• Prefer short-lived cloud credentials over long-lived PATs in agent configs

Add a team rule: “If it was in the chat, rotate.”

4. Repo and tenant isolation

Clarify:

• Are embeddings isolated per tenant / org?
• Can another customer’s retrieval ever surface your snippets? (Demand a clear no + architecture note.)
• Is on-prem / VPC / private networking available if you need it?
• What happens to indexes when you offboard — deletion SLA?

For regulated data, “we encrypt at rest” is not enough; ask about isolation and subprocessors.

5. Identity, SSO, and offboarding

• SSO / SCIM available for your IdP?
• Seat removal revokes tokens within a defined window?
• Audit logs exportable for your SIEM?
• Device/session revocation documented?

Privacy incidents often start as orphaned tokens, not model exfiltration.

6. Local vs cloud assistants

Local or self-hosted stacks reduce vendor prompt retention risk but shift burden to you: patching, model updates, GPU cost, and access control. Cloud assistants shift burden to vendor contracts and admin configuration. Choose explicitly; hybrid teams should document which repos may use which mode.

7. Trial protocol (privacy-aware)

During a 5-day trial:

1. Use a non-production clone or tightly scoped repo when possible
2. Enable the strictest retention settings you intend to use in prod
3. Attempt to paste a fake secret — confirm ignore rules fire
4. Export or review admin logs if available
5. Fill the privacy section of the comparison checklist
6. Record open questions for legal before purchasing

Do not trial on the crown-jewel monorepo “because that is where the real bugs are” unless security already approved.

8. Policy pack for the team (one page)

Ship an internal one-pager covering:

• Approved tools and forbidden tools
• Allowed repository tiers (public / internal / restricted)
• Rules for customer code and PII
• How to report a suspected leak
• Link to vendor DPAs and your ticket queue for exceptions

Assistants without a written policy become shadow IT.

Copy-ready checklist

• Data flow diagram for chat, index, agent, CI
• Training / retention settings verified in admin console
• Secret path ignore rules tested
• Tenant isolation + deletion SLA documented
• SSO / offboarding path works
• DPA / subprocessors reviewed by legal (as required)
• Team one-pager published
• Comparison checklist privacy section completed

Related reading

• Cursor vs Copilot vs Claude Code — decision matrix and quality trial
• Evaluate decisions with the comparison tool
• Production system prompts — if you wrap models in internal agents

Privacy review is a gate, not a vibe. Check the boxes, date the evidence, and revisit when the vendor ships a new “agent” mode that suddenly uploads more of your tree.

Red flags in vendor marketing

Treat these as prompts for deeper questions, not automatic disqualifiers:

• “We never train on your data” without defining which products and which plan tiers
• Vague “enterprise controls” with no admin screenshot path for retention
• Agent demos that require broad repo + shell access with no allowlist story
• Embedding features announced without a deletion/export story

Bring the red flag list to the vendor call; leave with written answers dated in your RFC.

When to delay adoption

Pause the rollout if:

• Legal cannot get a DPA in time for the data classes you process
• The only useful mode requires uploading restricted customer code
• Your secret-scanning / ignore rules cannot be enforced centrally
• Offboarding leaves indexes live past your policy window

A delayed assistant is cheaper than an incident write-up. Revisit when controls exist — not when a competitor blog post FOMO hits.