AI coding assistant privacy has become a pressing concern for developers, teams, and anyone who stores sensitive information in a codebase. When you write in an editor powered by Cursor, GitHub Copilot, or Windsurf, you’re not working locally in isolation. Every completion, every inline suggestion, every chat message involves sending your code — and often the surrounding context — to a remote model running on someone else’s infrastructure.
That’s not inherently a problem. The problem is that the scope of what gets sent, who can see it, and how long it’s retained is poorly understood, inconsistently disclosed, and widely underestimated.
How These Tools Actually Work
To suggest a completion or answer a question, an AI coding assistant needs context. Context means code: the file you’re editing, related files it imports, open editor tabs, recently modified files, and sometimes your entire project in the form of an indexed embedding.
That context is transmitted to a model for inference. The inference runs on remote servers — Microsoft’s Azure for GitHub Copilot, Anthropic and OpenAI infrastructure for Cursor depending on settings, and Codeium’s own hosted models for Windsurf. The interaction takes milliseconds, which makes it feel local. It isn’t.
What Gets Sent
The exact data varies by tool and configuration, but the typical package includes:
- The active file: the primary context for any completion.
- Related files: most assistants pull in files imported by or structurally connected to your active file.
- Codebase index data: when you enable codebase context, tools like Cursor create embeddings of your project files stored on their servers.
- Chat messages: everything you type in the assistant’s chat interface — including file paths, error output, and code snippets you paste explicitly.
- Agent context: tools in “agent mode” may also access clipboard content, terminal output, and results from tool calls.
The complete files aren’t always transmitted. Models work within a context window, and the tool’s retrieval logic selects the most relevant portion. But what’s selected can include far more than the function you’re currently editing.
The Inference Layer Problem
Most developers think about AI coding assistant privacy in terms of training — whether their code will be incorporated into a future model. That’s a legitimate question, but it’s secondary to a more immediate one: what happens during inference.
Even under enterprise contracts that explicitly prohibit training on your code, the code is still transmitted to a remote server for processing. A connection string in a config file, an API key in a test fixture, a database schema in a migration file — any of these can appear in the context window and leave your machine during an ordinary editing session.
GitGuardian’s research found that repositories using GitHub Copilot leak secrets at a rate 40% higher than repositories without AI assistance. The mechanism isn’t that Copilot exposes secrets directly; it’s that AI-assisted coding workflows create more surface area for credentials to appear in context sent for inference.
The question most developers haven’t asked: what leaves my machine, to which servers, and under which legal jurisdiction? A “no training” setting addresses future model improvement. It doesn’t address what the inference server receives, logs, or retains in the short term.
Retention Policies by Tool
What’s publicly stated varies considerably.
GitHub Copilot
For Copilot Individual accounts, Microsoft may use code snippets to improve models unless the user opts out. For Copilot Business and Copilot Enterprise, Microsoft commits to no training on organizational code.
In all tiers, Microsoft retains code snippets for up to 28 days for abuse detection before deletion. This retention applies even when training is disabled. Your code reaches Microsoft’s servers and stays there for up to a month regardless of your training preference.
Cursor
Cursor’s agreements with its model providers include zero-data-retention clauses — meaning Anthropic and OpenAI do not retain code after the inference request completes. Cursor itself may retain conversation history and codebase index data depending on your settings.
Privacy Mode in Cursor prevents code from being stored on Cursor’s own servers. Privacy Mode is not on by default and must be manually enabled in settings. Many developers assume it is on; most haven’t checked.
Windsurf (Codeium)
Codeium’s enterprise tier includes zero-data-retention guarantees from model providers. The individual tier’s handling is less precisely documented. Codeium states it does not train models on individual user data by default.
Codebase Indexing: The Persistent Copy Problem
Several tools offer “codebase context” — the ability to reference code from across your entire project, not just the file you’re currently editing. This feature requires indexing. The indexing process typically involves:
- Generating embeddings (numerical representations) of your code files
- Storing those embeddings on the provider’s servers
- Retrieving relevant embeddings at query time to populate context
Embeddings don’t look like source code, but they encode enough information about content and structure that they constitute a meaningful persistent representation of your project. Unlike inference traffic, which is ephemeral, codebase index embeddings sit on a server until you delete them.
Cursor’s codebase indexing is opt-in. When it’s disabled, the assistant works only from files open in the editor. For repositories containing regulated data or sensitive business logic, disabling codebase indexing is a straightforward control.
Agent Mode Expands the Surface
Tools in “agent mode” — Cursor Agent, GitHub Copilot Workspace, and similar features — can autonomously edit files, run terminal commands, and call external tools. This makes them significantly more capable for complex tasks and significantly broader in scope.
An agent working through a multi-step task may read configuration files, execute database queries, inspect environment variables, and modify files across your repository. The scope of what enters the context window during an agentic session is substantially wider than what a completion tool sees during a single suggestion.
Security researchers have demonstrated that malicious instructions embedded in files (prompt injection) can redirect agent behavior — causing an agent to exfiltrate data, modify files unexpectedly, or call external services. Before enabling agent features on a project, it’s worth being explicit about what the agent has access to and what it could read.
What You Can Actually Control
Disable codebase indexing for sensitive repositories. If a project contains credentials, healthcare data, financial records, or confidential IP, don’t enable codebase context. The capability loss is real; so is the data control gain.
Use ignore files. Most tools respect a .cursorignore or equivalent file that prevents specified files from appearing in context. Add your .env files, credential stores, and configuration files containing secrets to this ignore file — separately from .gitignore, which controls what’s committed, not what’s sent to an AI assistant.
Enable Privacy Mode explicitly. In Cursor, Privacy Mode prevents storage on Cursor’s servers. It’s not the default. Check your settings and enable it deliberately.
Understand your model provider’s jurisdiction. If you’re using Cursor with Anthropic models, the relevant retention policy includes Anthropic’s terms, not just Cursor’s. For regulated industries, the jurisdiction of the inference server matters for compliance purposes.
Consider local models for the most sensitive work. Tools like Continue.dev, Aider, and local Ollama setups support models running entirely on your machine, with no outbound network traffic for inference. The quality gap between local models and frontier cloud models has narrowed; for sensitive projects, local inference is a realistic option.
Personal Data in Codebases
Most discussions of source code privacy focus on proprietary business logic and trade secrets. But individual developers and small teams frequently have personal data in their codebases too.
Configuration files often contain real email addresses and phone numbers. Database seeds and test fixtures frequently include realistic user records to make tests meaningful. Log files committed to a repository contain IP addresses, session tokens, and behavioral data.
If personal data — yours or your users’ — is present in your codebase, it has the same exposure profile as your source code. It travels to the same inference servers under the same retention policies.
A Framework for Evaluating Your Exposure
When evaluating an AI coding tool, these questions produce a clearer picture than a checkbox reading “no training”:
- What is sent for inference? Is it just the active file, or are related files included? Can you see what’s in the context window before it’s sent?
- Who is the inference provider? Is it the tool’s own servers, or a third-party model provider? What are that provider’s retention terms?
- How long is data retained? Not “is training enabled” — but how long does code stay on their servers before deletion?
- Where do their servers operate? The legal jurisdiction of the inference server determines what law enforcement can request and under what process.
- What do agent features access? If you’re using agent or workspace features, what parts of your file system and environment are in scope?
These questions don’t have universally bad answers. Some tools have strong answers across the board. The point is to ask them before enabling a tool on a sensitive project, not after.