Third-Party Data Sharing and Embeddings

What it is

Your code queries are sent to third-party AI providers. If your administrator enables the embeddings feature, a full copy of your code repository is also sent to a third-party AI provider.

Why it matters (compliance & governance perspective)

This provision discloses that enabling the embeddings feature triggers transmission of full repository contents to a third-party provider, which is an operationally significant data sharing event that may not be apparent to individual users and is controlled at the administrator level.

Consumer impact (what this means for users)

Under this provision, both individual code queries and, if embeddings are enabled by an administrator, entire repository contents are transmitted to third-party LLM providers. The scope of this data sharing is stated to be limited to service provision, but the activation of embeddings represents a broader data transfer than routine query processing.

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: Transmission of full repository contents to third-party providers engages GDPR data transfer requirements, including requirements for data processing agreements and, for cross-border transfers, appropriate transfer mechanisms. CCPA service provider rules require that shared data be used only for the specified purpose. The provision states the sole purpose is service provision, which should be reflected in applicable DPAs. If repositories contain personal data, data subject notification obligations may be relevant. GOVERNANCE EXPOSURE: High. The embeddings feature involves transmission of entire codebases to a third-party provider, which is a materially broader data sharing event than individual query processing. This may include proprietary algorithms, credentials, personal data of employees or customers embedded in code, or regulated information. Administrator-level control over this feature means individual users may not be aware of the extent of data sharing. JURISDICTION FLAGS: EU and EEA organizations must ensure that full repository transfers to third-party LLM providers are covered by valid data processing agreements and, where applicable, Standard Contractual Clauses or other GDPR transfer mechanisms. California organizations should assess whether repository contents include personal information subject to CCPA. Organizations in regulated industries such as financial services or healthcare should assess whether repository contents include regulated data before enabling embeddings. CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should document which third-party LLM providers receive repository data when embeddings are enabled and ensure those providers are covered by appropriate DPAs. The document does not name the specific third-party LLM providers, which may require supplementary disclosure requests. Administrator training on the data sharing implications of enabling embeddings is advisable. COMPLIANCE CONSIDERATIONS: Organizations should classify repository contents before enabling embeddings and conduct a data protection impact assessment covering the full repository transfer. Access controls for the embeddings feature should be reviewed to ensure only appropriately authorized administrators can enable it. Data maps should be updated to reflect this third-party transfer pathway.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• User Ownership of Inputs and Outputs medium
• No Model Training on Customer Code medium
• Zero Retention Data-Sharing with LLMs medium
• Bring-Your-Own-LLM Data Protection Carve-Out high
• Full IP Indemnification medium
• Liability Cap for Confidentiality and Data Security Breaches high

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.