CodeRabbit procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ In accordance with Article 27 of the GDPR, we have appointed the following EU Representative:” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Our servers are located in the United States, and your personal information passes through servers located in this geographic area. If you are accessing the Services from another country, please be advised that you may be transferring your personal information to such geographic areas and countries and you consent to that transfer, processing, and storage of your personal information in accordance with this Privacy Policy. You also agree to abide by the applicable US federal, state, and local laws concerning your use of the Services and your agreements with us. Any persons accessing our Services from any jurisdiction with laws or regulations governing the use of the Internet, including the collection, use, or disclosure of personal information, different from those of the jurisdictions mentioned above may only use the Services in a manner lawful in their jurisdiction. If your use of the Services is unlawful in your jurisdiction, you may not use our Services.” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ art-27-rep-coderabbit@rickert.law ” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ In accordance with Article 27 of the UK GDPR, we have appointed the following UK Representative:” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | medium | “ Our servers are located in the United States , and your personal information passes through servers located in this geographic area. If you are accessing the Services from another country, please be advised that you may be transferring your personal information to such geographic areas and countries and you consent to that transfer, processing, and storage of your personal information in accordance with this Privacy Policy. You also agree to abide by the applicable US federal, state, and local laws concerning your use of the Services and your agreements with us. Any persons accessing our Services from any jurisdiction with laws or regulations governing the use of the Internet, including the collection, use, or disclosure of personal information, different from those of the jurisdictions mentioned above may only use the Services in a manner lawful in their jurisdiction. If your use of the Services is unlawful in your jurisdiction, you may not use our Services.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ art-27-rep-coderabbit@rickert-services.uk ” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ A data protection officer has been appointed and can be reached at dpo@coderabbit.ai for any questions.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Unless you request that we delete certain information (see Your Rights and Choices Regarding Your Information ), we will retain your personal information for the period necessary to fulfill the purposes outlined in this Privacy Policy unless a longer retention period is required or permitted by law. The criteria used to determine our retention periods include: · The length of time we have an ongoing relationship with you and provide services to you (for example, for as long as you have an account with us or keep using the Website); · Whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them). · Whether retention is advisable considering our legal position (such as, for statutes of limitations, litigation, or regulatory investigations).” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ Upon request, CodeRabbit will provide you with information about whether we hold any of your personal information. You are responsible for maintaining the accuracy of the information you submit to us, such as your contact information. If you submit a request to access all personal information you’ve submitted, we will respond to your request to access within 30 days or as otherwise required by law. We will use commercially reasonable efforts to honor your requests for deletion; however, certain residual information may actively persist on the Service even if you close your account. In addition, the rights described above may be limited, for example, if fulfilling your request would reveal personal information about another person, or if you ask us to delete information, we are required by law to keep or have compelling legitimate interests in keeping (such as for fraud prevention purposes). Your Personal Information may remain in our archives and information you update or delete, or information within a closed account, may persist internally for our administrative purposes, to the extent permitted by law. It is not always possible to completely remove or delete information from our databases. In addition, we typically will not remove information you posted publicly through or on the Service. Bear in mind that neither you nor CodeRabbit can delete all copies of information that has been previously shared with others on the Service. ” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ Unless you request that we delete certain information (see Your Rights and Choices Regarding Your Information ), we will retain your personal information for the period necessary to fulfill the purposes outlined in this Privacy Policy unless a longer retention period is required or permitted by law. The criteria used to determine our retention periods include: · The length of time we have an ongoing relationship with you and provide services to you (for example, for as long as you have an account with us or keep using the Website); · Whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them) · Whether retention is advisable; and considering our legal position (such as, for statutes of limitations, litigation, or regulatory investigations).” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “If your information is deleted, then your account may become deactivated. If your account is deactivated or you ask to close your account, you will no longer be able to use the Services. Please note that our Services require a minimum amount of Personal Information in order to function. European residents who do not provide Personal Information (e.g., by not creating an account) may not be able to access the full functionality of features found on CodeRabbit.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “If possible, CodeRabbit will notify Customer of such suspension or termination as early as commercially reasonable. 5.4 Effect of Termination. Upon expiration or earlier termination of this Agreement, Customer shall immediately discontinue use of the Services and all rights and obligations will immediately terminate, except that any terms or conditions that by their nature should survive such termination will survive, including Sections 3-13. No expiration or termination will affect Customer’s obligation to pay all fees due, whether invoiced or not, before such expiration or termination, or entitle Customer to any refund, with the exception of termination for cause by Customer as expressly set forth in Section 5.2, above. Customer is solely responsible for retaining copies of any Customer Data uploaded to the Services as upon termination of Customer's Account, Customer will lose access rights to any Customer Data uploaded to the Services. If the Agreement has been terminated for cause by CodeRabbit, Customer is prohibited from creating a new account on the Services using a different name, email address, or other forms of account verification.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We do not sell personal information to third parties. We share information we receive about you as follows: With Our Service Providers: We employ third-party companies to provide Services on our behalf, to perform Service-related operations (e.g., without limitation, maintenance services, database management, web analytics, server hosting, fraud detection and improvement of CodeRabbit’s features) or to assist us in providing and analyzing how our Service is used. For example, we use Stripe to process your payments, and have partnered with Chargebee to maintain your subscriptions. These third parties may have access to your Personal Information in order to perform these tasks on our behalf. We use Mailchimp as our e-mail marketing service provider. You may access their privacy policy here: https://mailchimp.com/legal/privacy/ . For Our Service Integrations: We allow for a variety of Service integrations to provide you with the best possible functionality while using our Services. For example, we integrate with: o GitHub and GitLab for code containment.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ o Linear for productivity; and” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ - OpenAI’s privacy policy is available here .” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ - Anthropic’s privacy policy is available here .” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Our Services may contain links and/or features to other websites and/or online platforms operated by third parties. We do not control such other online platforms and are not responsible for their content, their privacy policies, or their use of your information.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Your Personal Information is processed in accordance with the privacy policies and practices of such Service integration companies. For Corporate Transactions: CodeRabbit may share information, including Personal Information, with any current or future subsidiaries or affiliates, primarily for business and operational purposes, in connection with a merger, acquisition, reorganization or sale of assets (including, in each case, as part of the due-diligence process with any potential acquiring entity) or in the event of bankruptcy. If Required By Law: CodeRabbit will disclose information about you to government or law enforcement officials or private parties as we, in our sole discretion, believe necessary or appropriate to respond to claims and legal process (including but not limited to subpoenas), or, at the request of governmental authorities or other third parties conducting an investigation where we determine in our sole discretion the disclosure is necessary to (a) protect the property and rights of CodeRabbit or a third party, (b) protect the safety of the public or any person, or (c) prevent or stop activity we may consider to be, or pose a risk of being, illegal, fraudulent, unethical or legally actionable activity. With Your Consent: You may submit Personal Information to us through a form on the Website and consent to receive communication from us or our business affiliates and non-affiliates based on the information in the form.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ - Jira’s privacy policy is available here . ” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ o Anthropic for performing code reviews.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “Customer's use of the Third-Party Account is governed solely by its agreement with the applicable Third-Party Account provider (“ Third-Party Terms ”). Customer represents and warrants that it has all necessary rights, consents, authorizations and permissions to grant CodeRabbit access to its Third-Party Accounts as described in this Agreement without any breach by Customer of any Third-Party Terms and without subjecting CodeRabbit to any payment obligations, usage limitations or other liabilities. 3.3 AI. CodeRabbit's Services use artificial intelligence, powered via API integration by OpenAI and Anthropic or other third-party AI model providers with whom CodeRabbit may partner (each, a “ Third-Party AI Model Provider ”). Customer's proprietary code remains confidential with CodeRabbit. While the code is shared with Third-Party AI Model Providers, CodeRabbit has a zero data retention policy with each Third-Party AI Model Provider. Neither CodeRabbit nor its Third-Party AI Model Providers use Customer's code to train any AI models. CodeRabbit is not responsible for the accuracy, completeness, availability, timeliness, validity, copyright compliance, legality, decency, quality, security or any other aspect of any output or content provided or made available by any third party, provided that CodeRabbit will use commercially reasonable efforts to monitor third party outputs provided to Customers as part of the Services by third parties.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ - Linear’s privacy policy is available here .” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ o Jira for project management;” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ - GitHub’s privacy policy is available here .” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We do not sell personal information to third parties. We share information we receive about you as follows: With Our Service Providers: We employ third party companies to provide Services on our behalf, to perform Service-related operations (e.g., without limitation, maintenance services, database management, web analytics, server hosting, fraud detection and improvement of CodeRabbit’s features) or to assist us in providing and analyzing how our Service is used. For example, we use Stripe to process your payments, and have partnered with Chargebee to maintain your subscriptions. These third parties may have access to your Personal Information in order to perform these tasks on our behalf. We use Mailchimp as our e-mail marketing service provider. You may access their privacy policy here: https://mailchimp.com/legal/privacy/ . For Our Service Integrations** :** We allow for a variety of Service integrations to provide you with the best possible functionality while using our Services. For example we integrate with: o GitHub and GitLab for code containment.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ o OpenAI for performing code reviews.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Your Personal Information is processed in accordance with the privacy policies and practices of such Service integration companies. For Corporate Transactions: CodeRabbit may share information, including Personal Information, with any current or future subsidiaries or affiliates, primarily for business and operational purposes, in connection with a merger, acquisition, reorganization or sale of assets (including, in each case, as part of the due-diligence process with any potential acquiring entity) or in the event of bankruptcy. If Required By Law: CodeRabbit will disclose information about you to government or law enforcement officials or private parties as we, in our sole discretion, believe necessary or appropriate to respond to claims and legal process (including but not limited to subpoenas), or, at the request of governmental authorities or other third parties conducting an investigation where we determine in our sole discretion the disclosure is necessary to (a) protect the property and rights of CodeRabbit or a third party, (b) protect the safety of the public or any person, or (c) prevent or stop activity we may consider to be, or pose a risk of being, illegal, fraudulent, unethical or legally actionable activity. With your Consent** :** You may submit Personal Information to us through a form on the Website and consent to receive communication from us or our business affiliates and non-affiliates based on the information in the form.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ To comply with legal requirements and assist law enforcement.” | Captured 2026-06-08Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “CodeRabbit reserves the right to modify or terminate any Beta Products at any time and without notice. Notwithstanding any other section of this Agreement, all Beta Products are provided for evaluation purposes only, "as is" and without any representations, warranties, indemnifications, support, or SLAs and CodeRabbit's liability with respect to Free Trials shall be limited to an aggregate amount of $1,000. Beta Products may never be made generally available, and participation in a beta program does not guarantee continued access or future pricing. Customer is solely responsible for determining whether Beta Products are appropriate for its case, including with respect to any Customer Data that may be provided to Beta Products.” | Captured 2026-07-20Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “If Customer is compelled to make a deduction or set-off for any such Taxes, Customer will pay CodeRabbit such additional amounts as necessary to ensure receipt by CodeRabbit of the full amount CodeRabbit would have received but for the deduction. Any applicable direct pay permits or valid tax-exempt certificates must be provided to CodeRabbit prior to the execution of this Agreement. If CodeRabbit is required to collect and remit Taxes on Customer’s behalf, CodeRabbit will invoice Customer for such Taxes, and Customer will pay CodeRabbit for such Taxes in accordance with Section 8.1.” | Captured 2026-07-20Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ 8.1 Payments. Customer agrees to pay CodeRabbit the applicable fees set forth in all Order Forms and subsequent invoices. Fees are based on the applicable plan tier selected by Customer and the total number of “developer seats” selected, or if greater, provisioned, for seat-based Services during the applicable billing period, as well as the applicable usage billing rates for usage-based billing Services incurred during the applicable billing period as reflected in Customer’s Account. If Customer’s payment plan includes an ongoing subscription that is automatically renewed periodically, Customer hereby authorizes CodeRabbit to bill Customer’s payment instrument in advance on such periodic basis in accordance with the terms of the applicable Order Form until the expiration or termination of the applicable Order Form, and Customer further agrees to pay any and all charges so incurred. CodeRabbit may update fees from time to time, provided that any changes will take effect at the start of the next applicable billing cycle, and CodeRabbit will provide Customer with reasonable prior notice of any increase. Continued use of the Services after the new fees take effect constitutes acceptance of the updated pricing. 8.2 Taxes. Taxes payable by Customer may be calculated based on the billing information provided at the time of purchase. Customer will pay all applicable Taxes, excluding only those based on CodeRabbit’s income. ” | Captured 2026-07-20Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.