Last updated: July 2026 · Covers 9 tools on data routing, training use, certifications, and local model support
"Does this send my code to the cloud?" is one of the most common questions developers ask about AI coding tools, and one of the least clearly answered. Vendor marketing pages use similar-sounding language — "privacy mode," "we don't train on your code" — that hides real architectural differences in what actually happens to your code and who can see it.
This guide answers the question systematically, tool by tool, based on what each vendor discloses publicly. It covers data routing (where your code physically goes), training data policies, retention, compliance certifications, and the specific trade-offs for regulated industries.
Most privacy comparisons stop at "does it train on my code," which is only one of four questions that determine real risk exposure.
1. Where does my code go before reaching the AI model?
This is the architectural question everything else depends on. Subscription IDEs (Cursor, Windsurf, GitHub Copilot) route your code through their own infrastructure before it reaches the underlying model (Claude, GPT, Gemini). BYOK tools (Cline, Aider, Continue.dev) can be configured so your code goes directly to the model provider, with the tool vendor never in the data path at all.
2. Is my code used to train future models?
Separate from routing. A tool can route your code through its servers and still not use it for training — or use it for training only if you have not opted out. This is usually configurable but the default varies by tool and plan tier.
3. How long is my code retained, and by whom?
Even if code is not used for training, it may be logged or cached for debugging, abuse prevention, or performance monitoring — for a defined retention window that varies by vendor and is rarely prominently disclosed.
4. What compliance certifications exist, and do they cover my specific requirement?
SOC 2, HIPAA, FedRAMP, and ISO 27001 are not interchangeable — each addresses a different regulatory context, and a vendor having one does not imply the others. "Enterprise-grade security" in marketing copy is not a substitute for checking whether the specific certification you need actually exists.
The single most consequential difference across these tools is not a setting you toggle — it is baked into the architecture.
Cursor, Windsurf, and GitHub Copilot all route code through their own servers before it reaches the underlying AI model. This is inherent to how these products work — completions, chat, and agent actions all pass through vendor-operated infrastructure. Privacy Mode (Cursor) and similar settings control what happens to your code after it reaches their servers (stored or not, used for training or not) — but the routing itself is not something you can bypass while using the product as a hosted subscription.
Cline, Aider, and Continue.dev can be configured two ways:
This is a structural, not incidental, privacy advantage — there is no vendor infrastructure in the middle to configure a setting for, because none exists in this configuration.
Claude Code routes through Anthropic's own infrastructure (it is Anthropic's product, using Anthropic's models directly — no third-party intermediary vendor). Zed is BYOK-only for its AI features — code goes directly to whichever provider you configure, with Zed's own servers not in the data path, similar in architecture to Cline and Aider despite being a different kind of product (a full IDE rather than an extension).
Data routing: Through Cursor's infrastructure to the selected model (Claude, GPT-4o, Gemini).
Training use: Privacy Mode (Settings → Privacy Mode) stops code storage and training use. Off by default on some plans — verify your specific plan's default before assuming.
Retention: Not specified in detail publicly beyond the Privacy Mode toggle; Enterprise plans include additional data handling agreements with more specific terms.
Certifications: SOC 2 at the Enterprise tier. Not confirmed at Pro/Business tiers as of this writing — verify current status directly if this matters for your compliance requirement.
Local model support: No. Cursor requires cloud-based models; there is no on-premises or fully offline deployment option.
Best fit: Individual developers and teams without a hard compliance requirement, provided Privacy Mode is enabled.
Data routing: Through Windsurf's (Codeium's) infrastructure to the selected model, including its own proprietary SWE models or third-party options.
Training use: Paid plans do not use code for training by default.
Certifications: SOC 2 Type 2, HIPAA, and FedRAMP High at the Enterprise tier — notably more extensive than Cursor's disclosed certifications, making Windsurf Enterprise one of the few AI coding tools with FedRAMP High specifically, relevant for U.S. government contractors.
Local model support: No, cloud-based only.
Best fit: Teams needing FedRAMP or HIPAA specifically should evaluate Windsurf Enterprise ahead of competitors that do not disclose these certifications at all.
Data routing: Through GitHub/Microsoft infrastructure to the selected model.
Training use: Paid plans (Individual, Business, Enterprise) do not use your code for training by default — applied at the account level, not requiring an opt-out toggle.
Certifications: SOC 2, ISO 27001, GDPR compliance documented. The most extensively documented compliance posture of any tool covered here, reflecting Microsoft/GitHub's broader enterprise compliance infrastructure.
IP indemnity: Available on Business and Enterprise plans — GitHub contractually defends and covers costs if Copilot-generated code triggers a copyright claim. This is a meaningful legal protection not matched by most competitors.
Local model support: No.
Best fit: Organizations that need the most mature, well-documented compliance posture and specifically want IP indemnity as part of the contract.
Data routing: With BYOK, directly from your machine to your chosen provider (Anthropic, OpenAI, etc.) — Cline's own servers are never in the data path. This is the architectural default, not an optional privacy mode.
Training use: Governed by your chosen model provider's policy, not Cline's — since Cline is not the party receiving your code. Anthropic and OpenAI's paid API tiers do not train on API-submitted data by default.
Local model support: Yes, via Ollama or LM Studio. Code never leaves your machine in this configuration.
Certifications: Cline Enterprise includes SOC 2 and offers VPC deployment options — relevant if you need the team management layer to meet compliance requirements, separate from the model-provider question.
Best fit: Developers and teams who want the underlying architecture — not just a policy promise — to guarantee code does not pass through a third-party vendor's infrastructure.
Data routing: Identical architecture to Cline — BYOK sends code directly to your provider, Aider's code runs entirely locally as a CLI tool with no vendor servers involved at all (there is no "Aider Inc. infrastructure" to route through, since Aider is a local open-source tool, not a hosted service).
Training use: Governed entirely by your chosen model provider's policy.
Local model support: Yes, via Ollama or any local inference server.
Certifications: Not applicable in the traditional sense — Aider is a local open-source tool with no company managing your data. This is either a non-issue (there is no vendor to have a policy) or a limitation (no vendor-backed compliance certification or contractual indemnity exists either), depending on your organization's specific requirements.
Best fit: Developers who want the simplest possible architecture to reason about — code either goes straight to your chosen model provider, or nowhere at all if using a local model.
Data routing: Same BYOK architecture as Cline and Aider — direct to your chosen provider, or fully local via Ollama.
Training use: Governed by your chosen provider.
Local model support: Yes — Continue.dev's configurability makes assigning a local model to specific roles (autocomplete, chat) straightforward. See the Continue.dev Rules guide for the exact configuration.
Certifications: Open-source project; enterprise-managed deployments may carry additional guarantees depending on how your organization self-hosts or manages the tool.
Best fit: Teams wanting the most granular control over exactly which tasks use a local model versus a cloud model — for instance, autocomplete locally, complex reasoning via a cloud API.
Data routing: Directly to Anthropic's infrastructure — no third-party intermediary, since Claude Code is Anthropic's own product using Anthropic's own models.
Training use: Governed by Anthropic's API/commercial terms, which do not use customer prompts and outputs to train models by default for API and commercial product usage.
Certifications: SOC 2 Type 2. Enterprise agreements available with additional contractual terms.
Local model support: No — Claude Code is specifically built around Claude models; there is no local/offline model option.
Best fit: Teams already standardized on Anthropic models who want the most direct data path available among subscription tools (one company, not a tool vendor plus a separate model provider).
Data routing: BYOK — code goes directly to whichever provider you configure (Anthropic, OpenAI, Google, or 15+ others), with Zed's own servers not in the data path for AI requests specifically.
Training use: Governed by your chosen provider.
Local model support: Yes, via Ollama.
Certifications: As an open-source editor, the compliance question is largely about your chosen model provider rather than Zed itself.
Best fit: Teams wanting a full IDE (not just an extension) with Cline/Aider-style BYOK architecture rather than a subscription intermediary.
Data routing: Cloud by default; on-premises deployment available at the Enterprise tier — the model runs entirely on your own infrastructure, a genuinely different offering from every other tool covered here except local-model BYOK setups.
Training use: Configurable; enterprise deployments can be fully isolated from any external data transmission.
Certifications: SOC 2. The on-premises option is specifically designed for organizations where no code can leave their infrastructure under any circumstances — a stronger guarantee than "we don't train on your code," since there is no transmission to a third party to configure a policy around in the first place.
Best fit: Regulated industries (government, defense, healthcare with strict internal policies) where on-premises deployment is a hard requirement, not just a preference.
| Tool | Routes through vendor servers | Trains on code by default | Local model option | Notable certifications |
|---|---|---|---|---|
| Cursor | Yes | No (with Privacy Mode) | No | SOC 2 (Enterprise) |
| Windsurf | Yes | No (paid plans) | No | SOC 2, HIPAA, FedRAMP High (Enterprise) |
| GitHub Copilot | Yes | No (paid plans) | No | SOC 2, ISO 27001, GDPR; IP indemnity |
| Cline | No (BYOK) | Governed by provider | Yes (Ollama) | SOC 2 + VPC (Enterprise) |
| Aider | No (BYOK/local) | Governed by provider | Yes (Ollama) | N/A — no vendor infrastructure |
| Continue.dev | No (BYOK/local) | Governed by provider | Yes (Ollama) | Depends on self-hosted deployment |
| Claude Code | Direct to Anthropic | No (API/commercial terms) | No | SOC 2 Type 2 |
| Zed | No (BYOK) | Governed by provider | Yes (Ollama) | Depends on chosen provider |
| Tabnine | Configurable | Configurable | On-premises (Enterprise) | SOC 2 |
Windsurf Enterprise explicitly lists HIPAA among its certifications — one of the few AI coding tools to do so directly. Tabnine's on-premises deployment eliminates the external transmission question entirely, which some healthcare compliance teams prefer over a vendor's HIPAA attestation. A Business Associate Agreement (BAA) should be requested and reviewed directly with any vendor before processing PHI-adjacent code or data through any AI coding tool.
Windsurf Enterprise lists FedRAMP High — notably more specific than most competitors' general "enterprise security" language. FedRAMP authorization is a rigorous, government-specific process; confirm the specific authorization level (Low, Moderate, High) matches your contract's requirement, as these are not interchangeable.
No tool covered here specifically markets financial-services certifications as a headline feature. GitHub Copilot's combination of SOC 2, ISO 27001, and IP indemnity is the most extensively documented general enterprise compliance package. Tabnine on-premises remains the strongest option if internal policy prohibits external code transmission regardless of vendor certifications.
GitHub Copilot documents GDPR compliance directly. For EU-based teams with strict data residency requirements, confirm with any vendor where their infrastructure is physically located and whether EU-region processing is available. BYOK tools (Cline, Aider, Continue.dev) paired with an EU-region deployment of your chosen model provider shift this question to the provider's regional infrastructure rather than the coding tool vendor's.
Beyond the high-level "does it send code to the cloud" question, the specifics of what is transmitted vary and matter for a precise risk assessment.
Autocomplete requests typically send the current file's content plus some surrounding context (open tabs, recently edited files) — a relatively narrow slice of your codebase per request, sent very frequently.
Chat and agent requests typically send a broader context: the files you have explicitly added, plus in tools with codebase indexing (Cursor, Windsurf), potentially relevant files identified through semantic search across your entire indexed repository — meaning a single chat message can pull in content from files you did not explicitly reference.
MCP tool calls (see How to Set Up MCP Servers) introduce an additional data flow: content retrieved from an external system (a database query result, a GitHub issue body) becomes part of the model's context, meaning that data is now subject to whatever transmission and retention policy governs your AI tool, in addition to whatever policy governed the original system.
The practical implication: codebase indexing and MCP integrations both expand what gets transmitted beyond "the file I am currently looking at," in ways that are easy to overlook when evaluating a tool's privacy posture based only on its top-line policy statement.
Architecturally, Aider and Cline with a local Ollama model are the most private options available — code never leaves your machine in this configuration, and there is no vendor infrastructure in the data path at all. Among subscription tools, Tabnine's on-premises Enterprise deployment offers a comparable guarantee without requiring you to manage local model infrastructure yourself.
Not with Privacy Mode enabled (Settings → Privacy Mode). Verify the default setting for your specific plan, since defaults have varied across plan tiers and over time — do not assume Privacy Mode is on by default without checking.
GitHub documents SOC 2, ISO 27001, and GDPR compliance, but does not prominently market HIPAA compliance the way Windsurf does. If HIPAA compliance is a hard requirement, request a Business Associate Agreement (BAA) discussion directly with GitHub/Microsoft sales, and compare directly against Windsurf Enterprise's explicit HIPAA listing.
BYOK (Cline, Aider, Continue.dev, Zed) is an architectural difference — there is no vendor server in the data path at all, by design. A subscription tool's privacy mode (Cursor's Privacy Mode, for example) is a policy setting applied after your code has already reached the vendor's infrastructure — it controls what the vendor does with the code once received, not whether it was received in the first place. Both can result in your code not being used for training, but the underlying trust model is different: one requires trusting a policy, the other removes the need to trust a policy because the data flow structurally does not include the intermediary.
No — neither supports local/offline models. Both are cloud-based by design. If local model support is a hard requirement, Cline, Aider, Continue.dev, or Zed are the options, all of which support Ollama or similar local inference.
GitHub Copilot Business and Enterprise plans include IP indemnity — a contractual commitment to defend and cover costs if Copilot-generated code triggers a copyright claim. This is not standard across other tools covered here; confirm current terms directly with any vendor before assuming indemnity is included.
It depends on your specific NDA language and risk tolerance, not a universal answer. For the lowest-risk architecture, BYOK with a local model (Cline, Aider, Continue.dev, or Zed with Ollama) keeps code from ever leaving your machine. For cloud-based tools, review the specific vendor's training-opt-out setting, retention policy, and — for team/enterprise engagements — request a Data Processing Agreement (DPA) directly rather than relying on marketing-page summaries. See Best AI Coding Tools for Solo Freelancers for the freelancer-specific version of this question, and AI Coding Tools for Teams: Enterprise Guide for the procurement checklist to work through with a vendor.