Cody (Sourcegraph) procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “When we transfer the personal data of EEA, Swiss, and UK residents outside of those regions, we do so via appropriate user privacy safeguards, such as using Standard Contractual Clauses or obtaining your consent.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Sourcegraph will process Customer Content in accordance with the Security Exhibit .” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | medium | “Information we collect will be stored and processed in the United States in accordance with this Privacy Policy but we understand that users from other countries may have different expectations and rights with regard to their privacy.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “| Data Processing Agreement | We process any Customer Personal Data on your behalf |” | Captured 2026-06-09Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “If you remove information or content that you posted to the Services, copies may remain viewable in cached and archived pages of the Services, or if other users have copied or saved that informatio” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ You can remove your Personal Information from Sourcegraph at any time by deleting your account as described above. Sourcegraph will retain your information for as long as your account is active or as needed to perform our contractual obligations, provide you services, to comply with tax, legal, and audit obligations, resolve disputes, preserve legal rights, or enforce our agreements. For questions about reviewing, modifying, or deleting your account information, contact us at [email protected] .” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Sourcegraph has entered into partnerships with certain Large Language Models ("LLMs") ( "Sourcegraph Partner LLMs" ) to provide the services. Sourcegraph Partner LLMs will not retain any Input or Output from the model, including embeddings, beyond the time it takes to generate the Output ( "Zero Retention" ). This Zero Retention obligation does not restrict Sourcegraph from storing or persisting Inputs or Outputs to enable the functionality of the AI Tools.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | Enterprise | low | “Sourcegraph Partner LLMs will not retain any Input or Output from the model, including embeddings, beyond the time it takes to generate the Output ( "Zero Retention" ). This Zero Retention obligation does not restrict Sourcegraph from storing or persisting Inputs or Outputs to enable the functionality of the AI Tool” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ We may share your personal information with third parties in the instances described below.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “We may share your Personal Information with another entity in connection with a company transaction, such as a merger, acquisition, sale of assets or shares, reorganization, or bankruptcy. In these cases we may transfer some or all of your Personal Information to another entity, subject to this Privacy Policy. We may also share your Personal Information with any companies owned by or under common ownership with Sourcegraph, subject to this Privacy Policy. ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ No. We do not sell, share, or rent your Personal Information for cross-contextual behavioral” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “If you are a member of an Organization, we may share your username, email, IP address, and any collected logs about the user associated with that Organization with an owner or administrator of the Organization to investigate or respond to a security incident that affects or compromises the security of that particular Organization. ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Our service providers process your Personal Information as needed to provide our Services to you, including your content and processing prompts to help you write code. They may only process your Personal Information pursuant to our instructions and to perform their duties to us. See our Subprocessors page for a list of our service providers.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “Our service providers process your Personal Information as needed to provide our Services to you, including your content and processing prompts to help you write code. They may only process your Personal Information pursuant to our instructions and to perform their duties to us. See our Subprocessors page for a list of our service provider” | Captured 2026-06-07Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “| [Supplemental Terms for U.S. Government Users](https://sourcegraph.com/terms/gov) | You are using Sourcegraph as an employee or contractor of the U.S. Government |” | Captured 2026-06-09Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.