What is Code Excluded From Training?

Any AI review tool sends your source to a model. The question every security review asks is what happens to it afterwards: retained, logged, used as training data, or discarded after inference.

Look for this in the contract and the sub-processor list, not the marketing page. 'We do not train on your code' is a meaningful commitment only if it also binds the model provider sitting behind the vendor.

Top 19 Code Excluded From Training tools

Every tool in the directory documented as supporting Code Excluded From Training, 16 fully, 3 partially, with what its own documentation says.

Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.

1. 1
   CodacyQuality PlatformTeam

   AI Reviewer uses enterprise Gemini instances; code not used for training, secrets redacted, prompts not stored.

2. 2
   AikidoCode Security PlatformFree (all plans)

   "Never use, store, or train on customer data"; AI ops are inference-only, not retained

3. 3
   ChatGPT / CodexAgent Coding ToolBusiness

   Business and Enterprise business data is not trained on by default; not covered on Plus.

4. 4
   CodeAnt AIPR Review

   Does not train proprietary models on customer code; contractually excludes it from 3rd-party GPAI training

5. 5
   CodeRabbitPR Review

   Trust Center: code never used to train models; models trained solely on public datasets

6. 6
   CodeSceneQuality PlatformStandard

   Vendor states source code is never used to train or enhance the AI

7. 7
   CorgeaCode Security PlatformIncluded on all plans

   Your data is never used to train AI models; Zero Data Retention with OpenAI/Azure OpenAI

8. 8
   DeepSourceQuality Platform

   Privacy Policy: code not used to train AI models unless customer explicitly opts in via account settings

9. 9
   Gemini Code AssistAgent Coding ToolStandard

   Google does not use customer data to train models without permission; service stateless, no prompt storage by default.

10. 10
    GitHub Advanced SecurityCode Security PlatformCopilot Business or Copilot Enterprise plan

    GitHub does not use Copilot Business or Enterprise customer data to train AI models; individual plans differ

11. 11
    GreptilePR Review

    Opt out of anonymized cloud training; self-hosted code never trained on unless configured.

12. 12
    QltyQuality PlatformBusiness customers only

    Business customers' code is never trained on absent explicit opt-in; individual and open-source code may be.

13. 13
    QodoPR Review

    Context Engine MCP: no training on customer code, session-only retrieval, per-tenant isolation

14. 14
    SemgrepCode Security PlatformTeam

    Zero Data Retention agreement with default OpenAI provider; CI/CLI scans upload no code; BYOK loses ZDR.

15. 15
    SnykCode Security PlatformFree (all plans)

    "Does not use customer proprietary software code to train, optimize, fine-tune, or improve any AI models"

16. 16
    SonarQubeQuality PlatformEnterprise

    Third-party LLM providers contractually barred from training on input data across all tiers; SonarSource excludes Enterprise/Server data.

17. 17
    Claude CodeAgent Coding ToolPartialEnterprise

    Zero Data Retention for qualified Enterprise accounts; no explicit training-exclusion statement in source.

18. 18
    Cursor (Bugbot)PR ReviewPartialTeam

    Team-wide Privacy Mode and Legacy Privacy Mode referenced; no explicit training-exclusion statement in source.

19. 19
    VeracodeCode Security PlatformPartial

    A Veracode Fix whitepaper states customer code is never used to further train that model, but the commitment is scoped to Fix only; a platform-wide statement is gated behind Veracode's Trust Center.

What to look for

• Whether the guarantee extends to the underlying model provider
• Retention period for prompts and responses
• Whether it is contractual or a policy the vendor can change
• Zero-retention or enterprise inference endpoints, where offered

Related terms

FAQ