Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The Security Exhibit applies to all users of generally available Sourcegraph products and governs how Sourcegraph handles User Content, source code, and Confidential Information submitted through the platform.
This analysis describes what Sourcegraph Cody's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision identifies that source code and Confidential Information processed through Sourcegraph are subject to a dedicated Security Exhibit, which is a material consideration for enterprise customers whose proprietary codebases are processed by the Cody AI assistant.
Interpretive note: The full terms of the Security Exhibit are not reproduced in this document; the specific obligations, limitations, and confidentiality commitments cannot be assessed from this summary document alone.
Under this clause, any User Content, Code, or Confidential Information processed through Sourcegraph's generally available products is subject to the treatment described in the Security Exhibit. Enterprise customers should review the Security Exhibit to understand the specific obligations and limitations governing their source code and confidential data.
Cross-platform context
See how other platforms handle Security Exhibit Covering User Content, Code, and Confidential Information and similar clauses.
Compare across platforms →Monitoring
Sourcegraph Cody has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"You use any generally available Sourcegraph product or services and covers our treatment of your User Content, Code, and Confidential InformationExcerpt from Sourcegraph Cody's Sourcegraph Terms of Service
1. REGULATORY LANDSCAPE: The treatment of source code and Confidential Information may engage trade secret law (the Defend Trade Secrets Act in the U.S. and equivalent provisions in other jurisdictions), contractual confidentiality obligations, and sector-specific data protection requirements. For EU customers, processing of code that constitutes personal data may also engage GDPR. 2. GOVERNANCE EXPOSURE: High. Organizations submitting proprietary source code or confidential technical information to an AI-assisted development platform face potential exposure if the Security Exhibit's commitments regarding confidentiality, data retention, sub-processor access, or output use are not clearly defined or do not align with internal data classification policies. 3. JURISDICTION FLAGS: EU organizations should assess whether Sourcegraph's handling of code containing personal data satisfies GDPR transfer and processing requirements. U.S. organizations in regulated industries (financial services, healthcare, defense) should evaluate whether the Security Exhibit's commitments meet sector-specific data handling requirements. 4. CONTRACT AND VENDOR IMPLICATIONS: Procurement and legal teams should obtain and review the full Security Exhibit before submitting proprietary code to Sourcegraph's AI tools. The Exhibit's specific commitments regarding access controls, sub-processor disclosure, data retention periods, and incident notification timelines are material to vendor risk assessments. Any indemnification or liability limitations in the Security Exhibit should be evaluated against the organization's risk tolerance. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should map internal data classification policies against the Security Exhibit's provisions and determine whether proprietary code submitted to Sourcegraph triggers any internal or regulatory disclosure requirements. The Security Exhibit should be reviewed as part of any SOC 2 or ISO 27001 vendor assessment process.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision identifies that source code and Confidential Information processed through Sourcegraph are subject to a dedicated Security Exhibit, which is a material consideration for enterprise customers whose proprietary codebases are processed by the Cody AI assistant.
Under this clause, any User Content, Code, or Confidential Information processed through Sourcegraph's generally available products is subject to the treatment described in the Security Exhibit. Enterprise customers should review the Security Exhibit to understand the specific obligations and limitations governing their source code and confidential data.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Sourcegraph Cody.