AI Code Review Tools That Don't Train on Your Code, Compared

Several AI code review vendors say on their public pages that they do not train models on your code. Bito, CodeRabbit and Qodo say so (Qodo for paid plans). GitHub says it for Copilot Business and Enterprise, but not for individual plans. That covers only one of five things worth checking. Before a reviewer gets access to private repositories, also find out which model provider receives your code and on what terms, how long the vendor and the provider keep it, what goes to third parties such as Slack, and how deletion works.

Five checks behind "we don't train on your code"

An AI reviewer sends your diff, nearby files, pull request text and often comments to a large language model. Each step carries its own commitment, and a vendor can make one without the others.

Training and retention are separate. A vendor can promise never to train on your code and still keep it for months to power features. A provider can keep prompts for abuse monitoring without training on them.

What four vendors state, side by side

These four vendors each publish a no-training statement. Everything below comes from the vendor's own pages as read on October 26, 2026. Policies change, so check the current terms and your contract.

Bito

Bito's AI Code Review Agent page says "Bito neither reads nor stores your code, and none of your code is used for AI model training." Its Privacy and Security page names its model partners as OpenAI, Anthropic and Google. It says Bito reaches them through APIs and that "they do not store or train on data related to API access." For the review agent, Bito "ephemerally checks out the diff and clones the repo," and "after each code review is completed, the diff and the checked out repo are deleted." Usage metadata is "retained indefinitely for ongoing service improvement and customer support." The page lists Bito's third-party services, including AWS, Google Cloud, Microsoft Azure, OpenAI, Anthropic and Slack. It also says Bito can connect enterprises to their own private model accounts.

What to confirm: whether "do not store" means a zero data retention agreement with each provider, and what each listed service receives.

CodeRabbit

CodeRabbit's FAQ says "CodeRabbit never uses customer code for model training" and "Neither CodeRabbit, OpenAI, nor Anthropic uses your code to train our models." It adds that this holds "whether data retention is enabled or disabled." The retention setting "only controls whether CodeRabbit stores code-related data on our side to support features such as learnings and related review context." The FAQ lists what can be stored:

• "caching of encrypted code and dependency archives"
• "code indexing in which we store vector representations of code"
• "Learnings (opt out available)"

Model output logging is off by default. When it's on, model outputs and reasoning from private-repository reviews may appear in support troubleshooting logs. The FAQ says CodeRabbit "excludes prompts, does not use logged data for training." Self-hosted Enterprise customers can opt out of all data retention.

The point here: no training does not mean no storage. Vector representations are derived from your code.

GitHub Copilot code review

GitHub's model hosting page covers Copilot as a whole and does not mention code review specifically. It says GitHub does not use Copilot Business or Copilot Enterprise customer data to train AI models. For individual subscribers, "GitHub may use Copilot interaction data" for training, and individuals can opt out. Provider terms differ by model:

• OpenAI: "GitHub maintains a zero data retention agreement with OpenAI."
• Anthropic: the agreement covers "generally available Anthropic features." Some Anthropic features in beta or public preview are not covered. For some newer Claude models, Anthropic retains prompts and outputs by default to operate safety classifiers, with a time-bound exemption for eligible enterprises.

The point here: retention can depend on which model is selected, not just on which vendor you use.

Qodo

Qodo's current code review documentation does not include a privacy statement. The most specific public statement found is a September 2023 blog post, so confirm with Qodo before relying on it. The post says:

• "Data of our paid subscribers (or within the trial periods) will never ever be used to train our AI models."
• "We use data from our free-tier users to improve our AI models." Free users can request an opt-out.
• For hosted Qodo Merge Pro: "we will not store any of your Code or Pull Request data, nor will we use it for training."
• "OpenAI is obligated to zero data retention for qodo (formerly Codium) paid users."
• Some clients may be served by Qodo's own models, and "you will be notified."
• For the free self-hosted Qodo Merge used with your own OpenAI API key: "it is between you and OpenAI."

The point here: check both the plan tier and the date of the statement.

Retention: two clocks, plus data derived from your code

Ask about retention separately for each place your code can end up:

• The vendor. PR snapshots, cached repositories, embeddings or vector indexes, learned rules, logs and webhook payloads. Ask what the default period is and whether you can shorten it.
• The model provider. Either a zero data retention agreement or a default window. Warpway's Model providers page states that OpenAI may keep API inputs and outputs for up to 30 days to monitor for abuse. When a vendor says its provider stores nothing, ask which agreement that rests on.
• Derived artifacts. Review comments and check annotations posted to GitHub stay in GitHub. Evidence excerpts and embeddings are copies of your code, even if the full repository is deleted.

Slack and other third parties

Many review tools post to chat, and whatever lands in Slack follows Slack's retention, not the vendor's. Ask:

1. What text goes into a message? Can a diff or a code block end up there?
2. Does the app read channels, or only its own direct messages?
3. Which Slack scopes does it request, and why?

Warpway's answers are on its Slack installation page. Messages contain the repository, the pull request number and title, a plain-language question, what the code does today, why it matters and why the person was chosen. They contain no diffs or source files, and code blocks or diffs that slip into the text are replaced with a pointer to the details. Warpway requests no channel scopes and reads only the direct messages people exchange with the app.

Deletion: uninstalling is not deleting

Removing a GitHub App stops access, but it usually doesn't delete what the vendor already stored. Check who can delete organization data, how long it takes, what survives in backups, and which records are kept on purpose (billing and tax records, for example). Also check what subprocessors keep on their own schedules.

Worked example: what Warpway's docs state

Warpway reviews GitHub pull requests. It is a GitHub App. Its answers are on the Model providers, Data handling, Slack installation and Uninstall and deletion pages.

1. Vendor training. "Warpway does not train models on your code, your pull requests or your team's answers." Feedback such as false-positive marks is used to measure and improve review quality, and "is never used to train AI models."

2. Model provider. By default, the hosted service uses GPT-6 Sol from OpenAI for every review step, through OpenAI's Responses API with response storage turned off. Warpway can assign a different model to a step and configure fallback models for temporary errors. Warpway chooses the models for the whole service, not per customer. Every review records which model served each call. The docs list what the model receives, including:

• the diff and the file excerpts a lens reads
• pull request text, labels, comments and reviews, and commit messages
• the history and blame of files a lens examines
• linked issues, plus CI and runtime verification results
• your lens instructions and rules, and relevant organization knowledge
• the GitHub usernames and routing targets of people who may be asked
• answers to the pull request's questions

OpenAI does not train on data sent through its API unless the customer opts in, and Warpway has not opted in.

3. Retention. Warpway stores the pull request snapshot (including the diff), evidence excerpts of up to 4 KB each and task conversation text for the organization's retention period. That period defaults to 180 days, and an Owner can set it from 7 to 3,650 days. Review records (findings, questions, answers, policy results) are kept until the organization is deleted. Warpway does not store prompts or raw model responses, only metadata such as model, token counts and duration. Full repository snapshots live only in the review worker's temporary cache. Webhook payloads are deleted after 7 days. A redacting logger drops fields that carry code, diffs, prompts and model output. Data is in Neon Postgres in AWS us-east-1 and is processed in the United States.

4. Third parties. The Slack rules above, plus a published subprocessor list.

5. Deletion. An Owner deletes the organization from settings. A background job revokes the Slack token and removes everything tied to the organization. Only a record that the deletion happened is kept, with counts of what was removed and no customer content. Deletion is completed within 30 days, and deleted data can remain in encrypted backups until they expire. The Uninstall and deletion page explains that uninstalling the app stops access but does not delete data.

The disclosure also states what Warpway does not offer:

• Zero data retention at OpenAI is not the default. It's available for eligible uses, and organizations that need it should contact Warpway before installing.
• Bring-your-own-key is planned for an Enterprise plan that isn't available yet.

Questions to send a vendor before you install

Paste these into your security review or vendor questionnaire:

1. Do you train or fine-tune models on our code, PR text, comments,
   reviewer feedback or answers? Does this differ by plan or trial?
2. Which model providers and models receive our code? Can that change
   without notice to us?
3. Do you have a zero data retention agreement with each provider?
   If not, how long does each keep prompts and outputs?
4. What do you store (snapshots, caches, embeddings, logs), for how
   long by default, and can we shorten it?
5. Which integrations (Slack, issue trackers, monitoring) receive code
   or code excerpts, and what do you read from them?
6. What does uninstalling do? How do we delete all our data, how long
   does it take, and what remains in backups or with subprocessors?

If a vendor's public pages already answer every question, the review goes quickly. Any gaps tell you what to ask about.