Removing a coding assistant extension is not the same as deleting a cloud index or revoking an installed GitHub App. A review agent may have copied repository content into a graph; an IDE assistant may retain local embeddings; conversations and debugging traces may outlive the account that created them. The offboarding process must track each storage layer.
What the official product can and cannot do
Bito documents a local index for one class of codebase questions, while Greptile describes cloud-stored customer data with a specific deletion and backup pathway. GitHub separately allows administrators to suspend or uninstall an App and to change selected repository grants. Each action affects a different resource; no single button can be assumed to erase all information everywhere.
A practical evaluation workflow
During onboarding, register the index location, retention schedule, tenant owner and delete procedure. To test offboarding, create a synthetic canary repository, enable indexing, then withdraw app access and request deletion. Ask for confirmation of active storage cleanup and backup expiry on the contractual schedule. Test that old agents cannot retrieve the canary content after access revocation.
Limitations and historical pitfalls
Technical deletion may be delayed by backups, logs and legal holds. A client-side cache can persist after the server index disappears. Vendor statements should be distinguished from observed behavior: this article provides a repeatable assessment method, not a claim that every service deletes data within a uniform timeframe.
Data handling and permission boundary
Before a regulated project is transferred to another business unit, inventory every bot and extension that had access. Record explicit approvals and deletion evidence. Avoid including actual trade secrets as canaries; use synthetic data and review provider support channels for cases where deletion controls are available only to administrators.
Who should use this approach
A practical companion to procurement and incident response for teams moving between tools or contractors. It matters particularly when an organization trials several overlapping assistants.
Alternatives and trade-offs
Keeping all inference self-hosted may simplify some retention tasks, but local indexes, user machines and backups still need lifecycle controls.
Version, tier, region and evidence status
This article is an editorial snapshot checked against first-party material on 2026-10-25. Version or historical applicability: Vendor pages checked at cutoff; tenant-specific retention unknown. The exact software build in a reader’s organization, eligibility by country, enterprise agreement, separate provider model rates, code retention and full regional list have not been validated; such fields remain unknown rather than being guessed. Product statements are attributed to first-party descriptions, not independent hands-on tests. License guarantees, prices and seat limits require AI 10 dated snapshots or signed terms. Unverified details do not become timeless facts because they appear in current online documentation.
Deployment acceptance checklist
- Write the intended job and acceptance criteria; record the installed client release, plugin publisher, connected model/provider and tenant.
- Use a consented test repository with zero real secrets; capture installation permissions, processor regions, Git App grants and available audit logs.
- Verify the task boundary with a test that should fail when unauthorized: blocked file, network host or protected branch.
- Review proposed changes or comments against known requirements; run regression, security and integration checks independently of the agent.
- Document the owner, offboarding procedure, rollback limits and whether a formal procurement/privacy sign-off is still pending.
Sources & Further Reading
- https://www.greptile.com/security (official technical material; original date 2026-10-18; checked 2026-10-25)
- https://docs.bito.ai/ai-code-reviews-in-ide/ai-that-understands-your-code/how-it-works (official technical material; undated/living source; checked 2026-10-25)
- https://docs.github.com/en/apps/using-github-apps/reviewing-and-modifying-installed-github-apps (official technical material; undated/living source; checked 2026-10-25)