Change three separate things before using an AI coding assistant on sensitive work: whether the provider may use your interactions to improve models, which repositories and files the tool can index or retrieve, and what its agents or connected tools can access. A training opt-out does not turn off indexing, and a file-exclusion rule is not necessarily a boundary for every agent or workflow. The right settings depend on your account plan, organization policy, repository, and whether you are using an IDE, CLI, or cloud agent.
Which privacy settings should I review first?
Start by identifying the product, account type, workspace policy, and interface you actually use. The same provider can apply different defaults to individual and managed plans, while an IDE extension, command-line tool, and cloud agent may not share the same protections.
- Check model-improvement controls. Find out whether your plan permits interactions to be used for training or improvement, and whether an opt-out is available or already controlled by an organization.
- Check repository and file scope. Determine which repositories the assistant can search, whether it indexes them automatically, and how it handles files outside a hosted repository.
- Check agent permissions. Review cloud-agent repository access, network access, connected tools, and any other capabilities that could reach beyond the prompt or open file.
- Verify each workflow. An IDE exclusion rule may not apply to CLI use or an agent mode. Check the vendor’s documented limits for the exact surface you plan to use.
These are separate questions, not three names for the same privacy control. A provider may process code to answer a request even when it does not use that code for training; indexing governs retrieval and context, while agent permissions govern what actions or resources are available.
Can an AI coding tool use my conversations for training?
It depends on the provider and plan. GitHub and OpenAI document different rules for individual and business accounts, so check the control for your own account rather than assuming that a setting shown in one plan exists in another.
GitHub Copilot
GitHub says that, beginning April 24, 2026, interactions from individual Copilot Free, Pro, Pro+, and Max plans may be used for model training and improvement. If you do not consent, inspect Copilot settings and set Allow GitHub to use my data for AI model training to Disabled. GitHub says Business and Enterprise customer data is not used for that purpose without customer authorization; the personal opt-out switch is not shown on those plans. These are GitHub’s plan-specific statements, not a general rule for AI coding tools.
OpenAI Codex
OpenAI says ChatGPT training-data controls also apply to content processed through Codex, including screenshots taken by Computer Use. Its Help Center says conversations on Pro and Plus may be used to improve models unless training is turned off; business products have different defaults. Review the applicable ChatGPT data controls for the account you use. A team or organization account may be governed by its business-product terms and settings rather than an individual account preference.
Turning off model training answers only whether interactions may be used to improve models under the documented policy. It does not establish that code will not be sent for a request, saved as project context, indexed, or made accessible to an agent. Check those controls separately.
Does Copilot index my repository?
Yes: GitHub says Copilot Chat repository context automatically indexes the repository. GitHub also says indexed repositories are not used for model training, which is distinct from whether repository material can be retrieved to answer a coding question.
GitHub’s documentation states: “Copilot will not use your indexed repository for model training.” That statement is specifically about training. It is not an indexing opt-out, nor does it mean that repository context is unavailable to Copilot features.
What happens to a non-GitHub workspace in VS Code?
GitHub says VS Code semantic indexing for workspaces not hosted on GitHub uploads data to GitHub. For managed Copilot Business and Enterprise seats, this feature is disabled unless an organization or enterprise owner explicitly enables it. If you work with a local or otherwise non-GitHub project, check the organization’s policy and the indexing behavior of the particular VS Code feature rather than treating “not hosted on GitHub” as “not uploaded.”
GitHub says initial indexing of a large repository can take up to 60 seconds. That is a possible setup time, not a privacy or security measure.
How do I limit which repositories a cloud agent can access?
For a personal GitHub Copilot account, the cloud-agent Repository access control offers No repositories, All repositories, or Only selected repositories. Choose only selected repositories if the agent is needed for a limited set of projects; choose no repositories if you do not use the cloud agent.
Repository access is an authorization boundary for the cloud agent, not a control over all Copilot features. Confirm the setting applies to the account and agent you are about to run. If an organization manages your seat, ask which organization policy applies instead of assuming your personal setting can override it.
How do I exclude .env files and other sensitive paths?
Keep credentials out of the working context first, then use the product’s own exclusion feature to reduce exposure of secret files, private configuration, and confidential directories. Exclusions can help, but their coverage depends on the product and the surface using the files.
GitHub Copilot content exclusion
GitHub documents content exclusion for Copilot Business and Enterprise. The control can be configured at repository, organization, and enterprise scope, with documented examples including .env files and files whose names indicate they contain secrets. Organization rules can also address files outside Git repositories. This is an administrator or owner control; do not assume it is available as a personal-plan setting.
Use the narrowest appropriate scope and make exclusions explicit for the files and folders that should not be used as Copilot context. GitHub documents limitations: Copilot CLI and IDE Copilot Chat Agent mode do not support content exclusion. Its documentation also discusses indirect IDE semantic information, symlinks, and remote filesystems as limitations. An exclusion should therefore not be treated as a promise that no related information can reach every Copilot feature or connected tool.
Devin Desktop path exclusions
Devin Desktop documents a repository-root .devinignore file for excluding additional paths from indexing and agent access, in addition to its default ignore rules. It also documents a global .codeiumignore for enterprise users. Those are Devin-specific semantics; do not assume a similarly named file, or GitHub’s content exclusion, behaves the same way in another coding tool.
In any tool, an ignore rule is only as useful as its coverage. Check whether it covers retrieval, chat attachments, agent actions, terminal access, connected services, and files reachable through symlinks or remote mounts. If the documentation does not establish coverage for a surface, do not treat that surface as protected by the rule.
Does Agent mode respect content exclusion?
GitHub says IDE Copilot Chat Agent mode does not support content exclusion. Copilot CLI also does not support it, so an exclusion configured for supported Copilot features should not be assumed to protect those workflows.
For supported IDE experiences, GitHub says changes to exclusions can take up to 30 minutes to propagate to IDEs that already loaded settings. That is a possible propagation delay, not an average. Reload the relevant IDE settings where appropriate, then verify the behavior in the exact workflow that matters.
How to verify an exclusion
- Confirm the rule is configured at the correct repository, organization, or enterprise scope and includes the path you intend to exclude.
- Allow for GitHub’s documented propagation window if the IDE already had settings loaded; reload the applicable IDE settings where appropriate.
- Compare inline suggestions in a normal file with suggestions in an excluded file, following GitHub’s documented test procedure.
- Check whether Copilot Chat can use an excluded file when it is attached as context, also following the documented procedure.
- Repeat the check in each relevant surface. A successful IDE check does not establish that CLI or Agent mode supports the same exclusion.
Testing the rule this way checks observable feature behavior; it does not prove that every indirect path, agent, or connected service is blocked. GitHub specifically notes limitations involving indirect IDE semantic information, symlinks, and remote filesystems.
What other permissions should I restrict?
Remove access that is not needed for the task. This reduces unnecessary reach, but it does not change training policy or turn an exclusion into a comprehensive security boundary.
For Copilot
- Restrict cloud-agent repository access to selected repositories when possible, or to no repositories when the agent is unused.
- Disable partner agents and web search if you do not need them.
- Review organization or enterprise controls if the seat is managed; those policies can determine what individual users can change.
For Codex
- Review sandbox mode and network access before running a task against sensitive work.
- Check project trust and inherited environment variables, which can affect the context or capabilities available to a local workflow.
- Review enabled MCP servers and other connected tools, and disable those that are unnecessary for the task.
OpenAI documents that Codex local workflows run on the device and cloud tasks run in OpenAI-managed environments. The execution location alone does not establish what data is sent during a request, so consider it alongside the training controls, task context, sandbox, network, and connected tools.
What does “Suggestions matching public code” control?
GitHub Copilot’s Suggestions matching public code setting concerns whether matching suggestions are blocked where supported. GitHub describes a public-code match check that compares roughly 150 characters surrounding a suggestion; that figure relates to output matching, not repository-index storage.
This setting is about potential resemblance in generated output. It is not an opt-out from input processing, a control over repository indexing, or a restriction on what an agent can access. Choose it based on your policy for code suggestions, then configure training, indexing, and permissions independently.
What should I do before opening a sensitive project?
Use this short preflight for each account and workflow, especially when switching between an IDE extension and a cloud or command-line agent.
- Confirm whether the account is individual or managed and identify the applicable training control.
- Set the model-improvement preference you want, if the plan offers one.
- Review automatic indexing and any upload behavior for the workspace type, including non-hosted VS Code workspaces.
- Limit cloud agents to the repositories they need, and remove unused web search, partner agents, network access, or MCP tools.
- Keep secrets out of the workspace context and configure documented exclusions at the right administrative scope.
- Verify exclusions in the exact IDE, chat, CLI, or agent workflow rather than relying on a setting’s name.
For work governed by an employer or client, follow its policy even if a personal preference differs. When the vendor does not document protection for a particular surface or access path, treat that protection as unestablished rather than assuming the setting covers it.
Frequently Asked Questions
Does turning off AI training delete code or conversations already processed?
The documented training opt-out describes whether interactions may be used for model improvement; it does not by itself establish deletion or retention terms for prior content. Check the provider’s separate retention and deletion policy for the account and product you use.
Can I safely paste a production API key into an AI coding assistant if training is disabled?
No training setting is a substitute for keeping credentials out of prompts and project context. Follow your organization’s secrets-handling policy and rotate a credential if it has been exposed.
Does a local Codex task mean my code never leaves my computer?
OpenAI describes local workflows as running on the device, but execution location alone does not establish what request content or other data is transmitted. Review the account’s data controls and the task’s configured tools and permissions before sharing sensitive material.