AI capabilities
What does “code excluded from training” mean?
A vendor's documented commitment that your source code is not used to train its own or a third party's models.
Any AI review tool sends your source to a model. The question every security review asks is what happens to it afterwards: retained, logged, used as training data, or discarded after inference.
Look for this in the contract and the sub-processor list, not the marketing page. 'We do not train on your code' is a meaningful commitment only if it also binds the model provider sitting behind the vendor.
What to look for
- Whether the guarantee extends to the underlying model provider
- Retention period for prompts and responses
- Whether it is contractual or a policy the vendor can change
- Zero-retention or enterprise inference endpoints, where offered
Best 19 code quality, security and code review tools that exclude your code from training
Every tool in the directory whose documentation covers this, 16 fully and 3 partially. Full support is shown first. Shown in a random order that changes on every visit, so no tool gets an advantage from its position.
Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.
Code Security Platform
Aikido"Never use, store, or train on customer data"; AI ops are inference-only, not retained
AI Coding Agent
ChatGPT / CodexBusiness and Enterprise business data is not trained on by default; not covered on Plus.
Code Quality Platform
CodacyAI Reviewer uses enterprise Gemini instances; code not used for training, secrets redacted, prompts not stored.
PR Review Tool
CodeAnt AIDoes not train proprietary models on customer code; contractually excludes it from 3rd-party GPAI training
PR Review Tool
CodeRabbitTrust Center: code never used to train models; models trained solely on public datasets
Code Quality Platform
CodeSceneVendor states source code is never used to train or enhance the AI
Code Security Platform
CorgeaYour data is never used to train AI models; Zero Data Retention with OpenAI/Azure OpenAI
Code Quality Platform
DeepSourcePrivacy Policy: code not used to train AI models unless customer explicitly opts in via account settings
AI Coding Agent
Gemini Code AssistGoogle does not use customer data to train models without permission; service stateless, no prompt storage by default.
Code Security Platform
GitHub Advanced SecurityGitHub does not use Copilot Business or Enterprise customer data to train AI models; individual plans differ
PR Review Tool
GreptileOpt out of anonymized cloud training; self-hosted code never trained on unless configured.
Code Quality Platform
QltyBusiness customers' code is never trained on absent explicit opt-in; individual and open-source code may be.
PR Review Tool
QodoContext Engine MCP: no training on customer code, session-only retrieval, per-tenant isolation
Code Security Platform
SemgrepZero Data Retention agreement with default OpenAI provider; CI/CLI scans upload no code; BYOK loses ZDR.
Code Security Platform
Snyk"Does not use customer proprietary software code to train, optimize, fine-tune, or improve any AI models"
Code Quality Platform
SonarQubeThird-party LLM providers contractually barred from training on input data across all tiers; SonarSource excludes Enterprise/Server data.
AI Coding Agent
Claude CodePartialZero Data Retention for qualified Enterprise accounts; no explicit training-exclusion statement in Anthropic's documentation.
PR Review Tool
Cursor (Bugbot)PartialTeam-wide Privacy Mode and Legacy Privacy Mode referenced; no explicit training-exclusion statement in Cursor's documentation.
Code Security Platform
VeracodePartialA Veracode Fix whitepaper states customer code is never used to further train that model, but the commitment is scoped to Fix only; a platform-wide statement is gated behind Veracode's Trust Center.
Related terms
FAQ
What does “code excluded from training” mean?
A vendor's documented commitment that your source code is not used to train its own or a third party's models.
How many tools in the directory exclude your code from training?
19 of the 20 tools in this directory exclude your code from training, 16 fully and 3 partially:
Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.
What should you check when comparing tools that exclude your code from training?
Four things:
- Whether the guarantee extends to the underlying model provider
- Retention period for prompts and responses
- Whether it is contractual or a policy the vendor can change
- Zero-retention or enterprise inference endpoints, where offered