Before you paste code into an AI assistant: a 9-point check

The short answer

Consumer and business tiers of the same AI tool frequently have opposite defaults on the question that matters most: whether your input trains the provider’s models. Most people never check which tier they are on, and the free tier is usually the permissive one.

This is a checklist for establishing what you have actually agreed to. It takes about twenty minutes per tool and the answers are all published — they are just scattered across a privacy policy, a data processing addendum, a trust centre and a support article.

Why this is a security question, not a preference

If you are under an NDA, handling client code, or working somewhere with ISO 27001 or PCI DSS obligations, sending source code to a third party is a sub-processor decision. It needs a lawful basis, a data processing agreement, and a named sub-processor list. “I found it useful” is not a control.

The awkward part: this usually happens without anyone deciding it. A developer installs an extension, accepts the defaults, and the organisation has a new data flow nobody documented.

The nine points

1. Which tier are you on, and what does it change?

Establish this first, because every answer below depends on it. Free, individual-paid, team and enterprise tiers of the same product often differ on training use, retention, and whether a DPA is available at all.

2. Does your input train their models by default?

Look for the explicit statement, not the reassuring summary. Note whether the answer differs for prompts, completions, and telemetry — these are sometimes governed separately.

3. If there is an opt-out, what does it cover?

An opt-out from model training is not an opt-out from retention. An opt-out from retention is not an opt-out from abuse-monitoring review. Read what each toggle actually turns off, and whether it applies retroactively.

4. How long is input retained?

You want a duration. Common patterns are 30 days for abuse monitoring, longer for conversation history, indefinite for anything you explicitly saved. If the policy says only “as long as necessary,” treat the answer as indefinite.

5. Can humans see it?

Most providers reserve the right to have staff or contractors review flagged content for safety. That is defensible, and it is also a disclosure you owe your employer or client if their code is in scope.

6. Who are the sub-processors?

The model provider is rarely the only party. There is cloud infrastructure, often a separate inference provider, sometimes analytics. A mature provider publishes the list and notifies you of changes. An absent list is itself a finding.

7. Where is it processed?

If you have EU data residency obligations, establish whether residency covers inference or only storage. This distinction is where a lot of well-intentioned compliance work quietly fails.

8. Is there a DPA, and does it cover you?

For any professional use, you want a data processing agreement. Check whether it is available on your tier, whether you have to request it, and whether you need to actively accept it — an unaccepted DPA protects nobody.

9. What does the IDE extension send that you didn’t type?

This is the one people miss. Coding assistants often send surrounding context for relevance: neighbouring files, open tabs, repository structure, sometimes terminal output. You may have pasted one function while the extension shipped the file containing your credentials. Check the context-collection settings and whether there is a way to exclude paths.

Practical mitigations, in order of value

1. Get onto a business tier for professional work. Usually the single change with the largest effect on all nine answers.
2. Turn off training use explicitly, then verify it saved. Don’t assume the tier did it for you.
3. Configure path exclusions for .env, secrets directories, and anything holding credentials or personal data.
4. Never paste real personal data as test input. Generate synthetic data. This is a five-second habit that removes an entire category of problem.
5. Write it down. One page naming the tool, tier, DPA status and settings. When someone asks whether you have a policy, that page is the answer.

A note on the tone of most coverage

Discussion of AI coding tools focuses almost entirely on output quality — which model writes better code. That is a real question and other people measure it well. It is not the question your security team, your client contract, or your auditor is going to ask you.

Nobody is going to ask whether the model was clever. They are going to ask where the code went.