What to do
Review privacy at the data-flow level: what is collected, where it is processed, how long it is retained, whether it trains models, who can access it, and how deletion works. Marketing labels alone are insufficient.
Inventory the data
Include prompts, source files, repository metadata, terminal output, diagnostics, chat history, user identity, telemetry, and feedback. Classify whether each type may contain secrets, customer data, personal data, or protected intellectual property.
Validate controls and contracts
Check default and configurable retention, training use, subprocessors, processing locations, encryption, access logs, deletion, and enterprise agreements. Confirm whether local or self-hosted modes still call external services.
Control day-to-day use
Create rules for allowed repositories and data classes. Configure ignore files and organization policies, but test them: an exclusion feature is useful only if it covers chat, indexing, agent tools, and diagnostics consistently.
Practical checklist
Continue researching
This guide is an editorial framework, not a product endorsement. Recheck vendor documentation and your organization's requirements before making a purchasing or security decision.