An enterprise may prohibit exporting a private repository outside a region but still allow an editor extension to connect to a remote language model. The question is not where the developer is sitting. It is where source snippets, embeddings, diagnostics, review comments, uploaded logs and model requests are processed, stored and backed up.
What the official product can and cannot do
Provider materials illustrate why architecture matters: Alibaba documents a China-deployed Qoder CN stack, Greptile documents cloud infrastructure and self-hosting, and Augment describes distinct enterprise security controls. These are provider statements of architecture or options. None authorizes assuming the same region, subcontractors or deletion timeline for a different plan, tenant or integrated model.
A practical evaluation workflow
Draw a flow with the local IDE, indexing process, agent service, external model endpoint, repository host and logs. For each edge, record data categories, possible destinations, processor/controller roles and retention. Require a technical network trace on a consented test project, then compare it against the DPA and regional architecture promised by the vendor.
Limitations and historical pitfalls
A setting described as “local index” might still send retrieved snippets to inference. A statement about “zero training” does not mean zero retention, and server residency does not answer remote employee access or disaster-recovery geography. Vendor web pages may describe optional dedicated deployments not included in normal subscriptions.
Data handling and permission boundary
Use a test repository with synthetic regulated strings and monitor whether they appear in prompts, chat exports, telemetry and error reports. Disable plugins that violate egress policy and review external MCP servers separately. Keep a record of provider commitments with an effective date, plan, region and contracting entity.
Who should use this approach
Essential for regulated, government, medical, financial and export-controlled code, with local counsel and privacy officers making jurisdictional determinations. This article is an architecture checklist, not legal compliance certification.
Alternatives and trade-offs
Self-hosting can reduce some transfers but shifts hosting responsibilities. For many teams, a contracted enterprise SaaS with auditable regional controls may be easier to operate safely.
Version, tier, region and evidence status
This article is an editorial snapshot checked against first-party material on 2026-10-25. Version or historical applicability: Vendor security policy pages checked 2026-10-25. The exact software build in a reader’s organization, eligibility by country, enterprise agreement, separate provider model rates, code retention and full regional list have not been validated; such fields remain unknown rather than being guessed. Product statements are attributed to first-party descriptions, not independent hands-on tests. License guarantees, prices and seat limits require AI 10 dated snapshots or signed terms. Unverified details do not become timeless facts because they appear in current online documentation.
Deployment acceptance checklist
- Write the intended job and acceptance criteria; record the installed client release, plugin publisher, connected model/provider and tenant.
- Use a consented test repository with zero real secrets; capture installation permissions, processor regions, Git App grants and available audit logs.
- Verify the task boundary with a test that should fail when unauthorized: blocked file, network host or protected branch.
- Review proposed changes or comments against known requirements; run regression, security and integration checks independently of the agent.
- Document the owner, offboarding procedure, rollback limits and whether a formal procurement/privacy sign-off is still pending.
Sources & Further Reading
- https://www.greptile.com/security (official technical material; original date 2026-10-18; checked 2026-10-25)
- https://www.augmentcode.com/security (official technical material; undated/living source; checked 2026-10-25)
- https://www.alibabacloud.com/help/en/lingma/introduction-of-lingma (official technical material; undated/living source; checked 2026-10-25)