Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
“While we are committed to maintaining industry-standard or better security practices and continuously work to protect your data, no method of transmission over the Internet is completely secure. We cannot guarantee absolute security...”
“these limited data elements may still be accessible to your organization's administrators as necessary to maintain the organizational workspace.”
“We do not use your personal data for decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.”
“we retain limited data elements necessary to maintain the integrity of the organizational workspace for as long as your organization maintains an active workspace with us.”
“We do not sell or share personal data for cross-context behavioral advertising as defined under applicable privacy laws.”
“We do not intentionally collect government-issued identification numbers, health information, or other sensitive personal data as defined under applicable law.”
This document explains how Sourcegraph Cody handles your personal data: it collects metadata about your AI interactions (such as prompt titles and interaction patterns), keeps your data for as long as your service relationship is active, and does not sell it for targeted advertising. If you ask for your data to be deleted, some data may still remain accessible to your organization's administrators for as long as your organization uses the service.
This privacy policy establishes Sourcegraph Cody's data collection, retention, sharing, and automated-processing practices for users of the Cody service. It prohibits the sale or sharing of personal data for cross-context behavioral advertising, automated decision-making that produces legal or similarly significant effects on users, and intentional collection or extraction of sensitive personal data or personal data from User Content—though each prohibition is qualified by the word 'intentionally,' leaving inadvertent collection outside its scope. Personal data is retained on an open-ended basis tied to contractual obligations, with certain data elements persisting indefinitely for organizational workspace integrity even after individual deletion requests. Cross-border transfers of personal data originating from the EEA, UK, or Switzerland are conducted under Standard Contractual Clauses approved by the European Commission and the UK Information Commissioner's Office.
As an individual user, your personal data is collected in the form of AI usage metadata—including prompt titles, prompt categories, and interaction patterns—and is retained for as long as Sourcegraph Cody needs it to deliver the service. A deletion request does not guarantee full removal: limited data elements remain accessible to organizational administrators for as long as the organization maintains an active workspace. Sourcegraph Cody does not make solely automated decisions that legally or similarly significantly affect you. Sourcegraph Cody cannot guarantee the security of data transmitted over the Internet, and once you enable a third-party integration, Sourcegraph Cody does not control how that third party handles your data. If you believe a child under 18 has submitted personal data, you can notify Sourcegraph Cody to trigger an investigation and potential deletion.
Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.
1 important change detected
3 versions captured · Latest change detected by ConductAtlas: June 2026
We withheld clauses we had published from this document. Each withholding is recorded in our correction log:
“While we are committed to maintaining industry-standard or better security practices and continuously work to protect your data, no method of transmission over the Internet is completely secure. We cannot guarantee absolute security...”
“these limited data elements may still be accessible to your organization's administrators as necessary to maintain the organizational workspace.”
“We do not use your personal data for decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.”
“we retain limited data elements necessary to maintain the integrity of the organizational workspace for as long as your organization maintains an active workspace with us.”
“We do not sell or share personal data for cross-context behavioral advertising as defined under applicable privacy laws.”
“We do not intentionally collect government-issued identification numbers, health information, or other sensitive personal data as defined under applicable law.”
“For personal data originating from the EEA, UK, or Switzerland, we rely on the Standard Contractual Clauses approved by the European Commission and the UK Information Commissioner's Office...”
“When you or your organization enable an integration, personal data may be shared with that third party under their privacy practices. We do not control how third parties collect, use, or share personal data.”
“AI feature usage (including types of Inputs submitted, prompt titles, prompt categories, query-derived metadata, and interaction patterns)”
“We do not intentionally extract, store, or use personal data from User Content for any purpose.”
“We retain your personal data for as long as necessary to perform our contractual obligations and provide the Services to you and your organization.”
Every distinct legal provision identified in this document. Featured provisions appear above with analysis.
Sourcegraph Cody has updated this document before. Monitor includes alerts from a daily check, structured change summaries, and monitoring for up to 20 platforms.
Need provision-level monitoring and regulatory mapping? Insight includes governance timelines, drift analysis, and full provision tracking.
Cross-platform context
See how other platforms handle Absolute security cannot be guaranteed and similar clauses.
Compare across platforms →Governance Monitoring
Structured alerts for policy changes, governance events, and provision updates across 343 platforms.