What leaves your repository when you use an AI coding assistant?

Cursor's current Search documentation says Instant Grep builds and queries its index on the machine; it does not upload code or paths to build that search index or store codebase embeddings for search. When the agent opens a match, however, that file content can enter a model request. ^[1]

Code can leave your machine without being used for training or kept as a permanent repository copy. Review transmission, storage, training and deletion separately, for the exact product surface, account and model you use. A local editor describes where you work; it does not describe every place your request is processed.

Take a hypothetical private payments repository. A developer asks why a refund test fails, attaches the error, and lets an assistant inspect the relevant function. The approval question is not simply whether the repository is private. It is which code, logs and identifiers enter that request, which services receive them, and what survives afterward.

The examples below cover selected Claude Code, Cursor and GitHub Copilot modes, using official documentation read on 19 October 2026. They are a comparison of specific data paths, not an exhaustive vendor privacy ranking or a compliance determination.

Map the destinations before choosing a mode

Five questions that “no training” does not answer

For the payments example, create a small record before choosing a product setting:

This is NO FEED's proposed review format. It makes missing information explicit. An unknown retention period should remain unknown until the relevant provider or contract answers it.

The confusion predates today's settings. In June 2025, Reddit user UnchartedFr asked how a Cursor privacy-mode email could combine model-provider zero retention with storage for product features. That historical question captures the distinction; it is not evidence of October 2026 policy, an observed leak or a broken promise. ^[2]

Compare the mode, not just the logo

These are documented defaults and conditions, not observations of your account:

The Copilot rows are GitHub's service-level FAQ defaults. They must be read alongside its model-hosting documentation: Claude Fable 5 and 5.1 involve provider retention by default, with qualified, configured enterprise exemptions described through the end of 2026. Other preview-feature exceptions also exist. A broad retention sentence is not a substitute for checking the selected model and feature. ^[6]

Individual Copilot subscriptions have another distinction. GitHub's March 2026 announcement describes model-training use of interaction data subject to user settings and an opt-out. It distinguishes data generated during a session, which can involve a private repository, from training on that repository's stored contents at rest. Business and Enterprise users were not affected by that update. ^[7]

For our developer, “private repo” and “paid subscription” therefore leave important questions unanswered. The actual account, organization policy and feature belong in the approval record.

A local search index and a model request are different paths

That changes the payments example. Finding the refund function locally does not mean the subsequent explanation is computed locally. Conversely, a remote model request does not establish that the entire repository was uploaded for an index. Describe each operation accurately instead of assigning one location to the whole product.

Cursor also says bringing your own API key does not bypass its backend, where it performs final prompt construction. Its data-use page describes temporary encrypted file-content caching and notes that, with Privacy Mode enabled, those cached contents are not used for training. These are separate from a promise that no content ever reaches a server. ^[4]

Cloud work introduces another object. Cursor's enterprise governance documentation describes temporary encrypted repository copies for Cloud Agents and says those copies are deleted after the agent completes. A policy that permits a request containing selected code but prohibits a hosted working copy needs to distinguish those features. ^[8]

Session history and feedback need their own rows

Claude Code's data-usage page says local clients keep plaintext transcripts under ~/.claude/projects/, normally for 30 days, with a configurable cleanup period and exceptions for sessions continued in Desktop or Cowork. It separately describes transcripts submitted through /feedback, /bug or /share as retained for five years. Those feedback submissions should not inherit an inference-retention assumption. ^[3]

Enterprise ZDR is also scoped. Anthropic says it covers eligible Claude Code inference on its direct platform, requires per-organization enablement and does not extend to third-party tools or MCP servers. The documentation retains legal and misuse exceptions. A personal login or a different organization does not automatically receive the approved organization's treatment. ^[9]

For our payments investigation, a copied error log could consequently appear in a model request, a local transcript and a later support submission. Review each transfer deliberately. Use synthetic customer identifiers when reproducing the failure; if real records are necessary, obtain the appropriate project decision before adding them to the task.

Make one real workflow explainable

Our proposed final check follows one non-sensitive sample from the actual account and product surface. Record the model, privacy setting, enabled integrations and whether execution is local or cloud. Observe which files the agent reads and what tools it calls. Compare available client or organization logs with the documented data paths; avoid collecting real secrets merely to test logging.

Network observations can show a destination was contacted. They do not prove a provider's retention or training behavior. For those claims, keep the dated official policy and applicable contractual answer with the record. Likewise, an absence of obvious traffic in a short sample is not proof that every feature is local.

Before granting access to the payments repository, finish one sentence precisely: “This account may send these inputs through these services, with these storage and reuse conditions.” If a newly enabled model, cloud agent or connector makes that sentence false, review that new path before using it with the repository.