Does GitHub Copilot train on your code?

Not on Copilot Business or Enterprise: GitHub says it doesn't use those customers' data to train AI models. Copilot Free, Pro, Pro+ and Max are different. Since April 24, 2026, GitHub may train on their interaction data unless the user opts out in Privacy settings.

Does Cursor train on your code?

Only with Privacy Mode off. With it on, Cursor says it won't train on your data and has zero data retention agreements with its model providers. Privacy Mode is on by default for teams; free and Pro users have to switch it on themselves.

Does Claude Code store or train on your code?

Under commercial terms (Team, Enterprise or API), Anthropic doesn't train on Claude Code prompts or code unless your organization opts in, and keeps them for 30 days. Zero data retention is a separate per-organization option on Claude for Enterprise. Claude Code also keeps plaintext transcripts on the developer's machine for 30 days.

What should never go into an AI coding tool?

Credentials (live or expired), private keys, customer personal data in fixtures or logs, and code a client NDA bars you from sharing. Block the obvious files with each tool's own controls, such as Copilot content exclusion, .cursorignore and Claude Code deny rules, rather than relying on memory.

AI coding tools policy: GitHub Copilot, Cursor, Claude Code

Image: Unsplash.

If your developers use Copilot, Cursor or Claude Code at work, the plan they're signed into decides whether their prompts and code can train a model. The business tiers of all three keep your code out of training. The personal tiers can use it, and GitHub switched its personal plans to training by default this spring. So the first line of an AI coding tools policy isn't which tool. It's which account.

This page gives you the plan-by-plan facts, a policy you can paste into your engineering handbook, and the settings that enforce it in each tool.

Which plans train on your code

We checked every row against the vendor's own page on October 15, 2026.

Tool and plan	Trains on your code?	How long prompts are kept	DPA
GitHub Copilot Business, Enterprise	No	IDE chat and code completions: not kept. Other Copilot surfaces: 28 days	Yes, GitHub DPA
GitHub Copilot Free, Pro, Pro+, Max	Yes from April 24, 2026, unless the user opts out	Not checked	Not checked
Cursor, team plans	No: Privacy Mode is on by default	Zero data retention with model providers; flagged abuse may be stored	Yes, tied to the Master Services Agreement
Cursor, free and Pro	Yes, unless the user turns Privacy Mode on	Same as teams once Privacy Mode is on	Not stated
Claude Code under commercial terms (Team, Enterprise, API)	No, unless the organization opts in	30 days; zero retention on Claude for Enterprise by arrangement	Yes, part of the Commercial Terms
Claude Code on Free, Pro, Max	The user's choice	5 years if training is allowed, 30 days if not	Not checked
Amazon Q Developer Pro	No	Not checked	Not checked
Amazon Q Developer Free tier	May be used, including for model training	Not checked	Not checked
Tabnine	No ("no-train-no-retain")	Discarded once the output is generated	Not checked
ChatGPT Free, Plus, Pro	Yes, unless the user opts out	Not checked	Not checked
Google AI Studio, unpaid Gemini API	Used to improve Google products, except for users in the EEA, Switzerland, and the UK, who get the paid-service data terms	Not checked	Not checked

Sources: GitHub model hosting docs, Copilot FAQ, Cursor data use, Cursor privacy help, Cursor DPA, Claude Code data usage, Anthropic DPA, Amazon Q service improvement, Tabnine privacy, OpenAI data use, Gemini API terms. If your app serves users in the EEA, Switzerland or the UK, Google's terms allow only its paid Gemini services.

The rule that follows: a personal plan isn't an approved path for company code, even when the developer pays for it out of pocket.

What changed at GitHub in April

GitHub Blog post headline: Updates to GitHub Copilot interaction data usage policy, with the standfirst saying interaction data from Copilot Free, Pro and Pro+ users will be used for training from April 24 unless they opt out

Screenshot: "Updates to GitHub Copilot interaction data usage policy", GitHub Blog, March 25, 2026.

On March 25, GitHub announced that from April 24 it would train on inputs, outputs and code snippets from Copilot Free, Pro and Pro+ users unless they opted out under "Privacy." Business and Enterprise weren't affected. Its docs now list Copilot Max with the individual plans.

Developers on r/github picked at it. One flagged the case most policies miss: "Those machine-generated interactions fall under the same opt-out, but the consent model was designed for a human accepting a suggestion," wrote ultrathink-art, pointing at CI bots and scripted completions. Others couldn't find the switch: the email started "with opt out instructions that are misleading," said Routine-Arm-8803.

https://www.reddit.com/r/github/comments/1s3kvms/starting_april_24_2026_github_will_begin_using/

If a developer has ever used a personal Copilot plan on company code, that's the account to move first.

Copy-paste policy: AI coding tools

Add this to your AI acceptable use policy or engineering handbook. Bracketed values are yours to set.

AI Coding Tools Policy: [Company Name] Version: 1.0 | Effective: [Date] | Owner: [Tech Lead / CISO]

1. Approved tools. Only the tools and plans below may be used on company code. Anything else needs approval from [Tech Lead / CISO] first.

Tool	Approved plan	Conditions
GitHub Copilot	Business or Enterprise	Signed into the company GitHub organization; content exclusion set for secret paths
Cursor	Company team plan	Privacy Mode stays on (team default); `.cursorignore` in every repo
Claude Code	Company Team, Enterprise or API account	Deny rules for `.env` and key files in the managed settings
[Other]	[Plan]	[Conditions]

2. Personal accounts. Personal or free plans of any AI tool (including Copilot Free, Pro, Pro+ and Max, Cursor free or Pro, and Claude Free, Pro or Max) must not be used with company or client code.

3. Never send to any AI tool:

API keys, passwords, tokens or other credentials, active or expired
Private keys and certificates
Customer personal data, including names, emails, IDs or payment data in test fixtures, logs or database dumps
Code or documents a client agreement or NDA bars from third-party sharing

4. Review. AI-generated or AI-suggested code is reviewed by a human before merge. The person who merges it is responsible for it as if they had written it.

5. Licensing. Before accepting a long verbatim suggestion (more than [N] lines) in code you'll ship under a different license, check it isn't copied from copyleft code (GPL, AGPL).

6. Agents and MCP servers. Only MCP servers on the approved list may be connected. Agents run with the narrowest file and command permissions that work.

7. If something leaks. Anyone who pastes a credential or customer data into an AI tool: stop, report to [security contact] within [24 hours], rotate the credential, and log it in the AI incident log.

8. Review cadence. This list is reviewed [quarterly]. New tools go through security review before they're added.

How to enforce it in each tool

A policy developers have to remember fails on a busy Friday. Each of the three tools has a setting that does the work.

GitHub Copilot. Buy Business or Enterprise seats through the organization, so nobody needs a personal plan. Then set content exclusion for paths like .env, secrets/ and fixture dumps. It's available to organizations on Business or Enterprise, repository admins and organization owners can set it, and excluded files don't feed suggestions in other files. For agent activity, GitHub's own session on managing and auditing Copilot agents is a useful walkthrough for admins:

Cursor. On a team plan, Privacy Mode is on for every member by default and new members inherit it, so the job is making sure nobody signs in with a personal account.

Cursor Data Use and Privacy Overview page, last updated September 3, 2026, explaining that with Privacy Mode on customer data is not used for training and with it off Cursor may use and store code data to train its models

Screenshot: "Data Use & Privacy Overview", Cursor, captured October 15, 2026.

Add a .cursorignore file for secrets, but don't treat it as a wall. Cursor's own docs say the terminal and MCP tools used by Agent can't be blocked by it, and that "complete protection isn't guaranteed due to LLM unpredictability." Cursor holds a SOC 2 Type II attestation, with reports available on request.

Claude Code. Sign developers in with the company's Team, Enterprise or API account; that's what puts their sessions under commercial terms. Add deny rules so it can't read secret files. Anthropic's settings docs show the pattern, "deny": ["Read(./.env)", "Read(./.env.*)"], and an organization can push it to everyone through managed settings.

Claude Code Docs Data usage page, Data retention section: consumer users 5-year retention if they allow model improvement and 30 days if not; commercial users 30-day standard retention, zero data retention for qualified Claude for Enterprise accounts, and local plaintext transcripts kept 30 days

Screenshot: "Data usage", Claude Code Docs, Anthropic, captured October 15, 2026.

Two things in that page are easy to miss. Claude Code sends all user prompts and model outputs to the model provider, not just the file you mention. And it keeps session transcripts on the developer's machine, in plaintext, for 30 days by default (the cleanupPeriodDays setting changes that). A transcript that contains a pasted key is a key on a laptop. Feedback sent with /feedback or /bug is kept for five years, so tell developers to scrub it.

MCP servers and agents

Agents that connect to MCP servers can read files, call internal APIs and run commands, which widens what leaves the machine. Anthropic's security docs are blunt about it: it encourages "writing your own MCP servers or using MCP servers from providers that you trust," says it doesn't security-audit any MCP server, and notes that reviewing a repo's .mcp.json doesn't show every server a session can load. That's why clause 6 is an approved list rather than a review of each repo. The same page reminds developers that they're responsible for reviewing proposed code and commands before approving them.

For the full control set, see the MCP server security governance checklist.

What this policy doesn't cover

Cost. Seat prices and usage credits are a separate control; see AI coding tool governance and cost control.
Pull request review rules for AI-written code: see the AI-generated pull request review policy.
Vendor security review. We didn't check SOC 2 reports for Copilot, Anthropic, Amazon Q or Tabnine this round, or the DPA terms for Tabnine, Amazon Q, ChatGPT and Google AI Studio. Run those through your vendor due diligence checklist; our AI vendor DPA tracker has the DPA links we've verified.
Export-controlled code. If you work under export rules, get counsel's view before any of this code reaches a hosted model.

Correction (October 14, 2026): The table said Cursor doesn't train on individual users' code when telemetry is off. Cursor's data-use page says it may train on code data unless Privacy Mode is on; teams get Privacy Mode by default. Three broken DPA links were also replaced. Details are in our AI vendor DPA tracker.

Correction, October 15, 2026: an earlier version said GitHub doesn't store code context after a suggestion is returned (that holds only for IDE chat and code completions on Business and Enterprise; other Copilot surfaces keep prompts 28 days), that Claude Code sends only what you explicitly ask about (Anthropic's docs say it sends all prompts and model outputs), and that Cursor stops logging when telemetry is off (its control is Privacy Mode). We removed a SOC 2 column we hadn't checked for every vendor, an unsourced Amazon Q indexing claim, and added the April 2026 change to Copilot's individual plans.

Correction (October 24, 2026): The Google AI Studio row said unpaid content is used to improve Google products without the exception in Google's terms: for users in the European Economic Area, Switzerland, and the UK, the paid-service data terms apply to AI Studio and the unpaid Gemini API quota too.