Is Sourcegraph Cody safe for work?
Low risk · 9Sourcegraph · Coding · facts (high-confidence)
Sourcegraph Cody is low-risk for default at-work use (9/100): it does not train on your data, and holds SOC 2 Type II.
9
Low risk
Watch out: A strong disclosure posture: SOC 2 Type II, ISO 27001:2022, a public DPA and subprocessor list, and a contractual no-training and zero-retention policy. The managed offering is US only (EU residency needs self-hosting).
Data and compliance facts
- Trains on consumer-tier data
- No
- Trains on business-tier data
- No
- Training opt-out available
- Unverified
- SOC 2 Type II
- Yes
- ISO 27001
- Yes
- ISO 42001 (AI management)
- Unverified
- GDPR Data Processing Addendum
- Yes
- HIPAA BAA
- Unverified
- EU data residency
- No
- SSO / SAML
- Yes
- Data retention
- Partner LLMs retain no input or output beyond generating the response (zero retention); general infrastructure logs retained up to 365 days.
- Safer tier
- Cody Enterprise (self-hosted or single-tenant): the only generally-available tier
Why it scores 9 out of 100
- +9EU data residency. Whether data can be kept in the EU.