Openwake · evidence pack

Sourcegraph

https://sourcegraph.com · record 510 · read 2026-10-09 · rules/v1 · generated 2026-10-23 04:07 UTC

Facts

Trains on customer data
no
“Partner Retention: Sourcegraph's third-party large language model providers ("Partner LLMs") will not retain any Input, Output, or Candidate Context beyond the time it takes to generate an Output ("Zero Retention"), except that Partner LLMs may temporarily retain Inputs and Outputs solely for the purpose of detecting and preventing abuse or serious harm, and will not use such data for model training or any other purposes, provided that you access Sourcegraph's AI Tools through Sourcegraph's Partner LLMs.”
terms · https://sourcegraph.com/terms/tos · confidence 0.60
Opt-out mechanism
none described
No supporting text found in the documents read.
privacy policy · https://sourcegraph.com/terms/privacy · confidence 0.20
AI features
present
“* Usage Data means data we generate or derive from your use of the Services that reflects how you interact with and use the Services, such as feature interaction data and usage patterns (including user identifiers associated with feature usage), feature flags and configuration settings, AI feature usage (including types of Inputs submitted, prompt titles, prompt categories, query-derived metadata, and interaction patterns), deployment information, system configuration data, session data, operational signals, and service health metrics.”
privacy policy · https://sourcegraph.com/terms/privacy · confidence 0.55
Model providers named
Anthropic, Fireworks AI, OpenAI
“Anthropic AI USA Processes user queries and code snippets submitted to Sourcegraph AI Tools”
subprocessors · https://sourcegraph.com/terms/subprocessors · confidence 0.60
Retention
1095 days
“Provider will maintain records of its processing activities and its compliance with this DPA as required by Applicable Data Protection Laws, and will retain such records for 3 years after the DPA ends.”
dpa · https://sourcegraph.com/terms/dpa · confidence 0.50
Hosting regions
United States
“Our servers and operations are located in the United States, and we have team members located around the world.”
privacy policy · https://sourcegraph.com/terms/privacy · confidence 0.50
Subprocessor notice
15 days
“Customer has 15 days after notice of a change to the Approved Subprocessors to object, otherwise Customer will be deemed to accept the changes.”
dpa · https://sourcegraph.com/terms/dpa · confidence 0.55

Subprocessors (7)

NameCategoryLocationQuoted from
Anthropicmodel providerUSA
“Anthropic AI USA Processes user queries and code snippets submitted to Sourcegraph AI Tools”
CloudflareotherUSA
“Cloudflare USA Processes customer request data such as IP addresses to optimize security and performance of Sourcegraph Cloud and Sourcegraph.com”
Fireworks AImodel providerUSA
“Fireworks AI USA Processes user queries and code snippets submitted to Sourcegraph AI Tools”
Google Cloudhyperscalerunstated
“Provides cloud hosting for Sourcegraph.com and Sourcegraph Cloud (Google Cloud Platform). Stores dashboard analytics for Sourcegraph.com and Sourcegraph Cloud (BigQuery)”
OpenAImodel providerUSA
“OpenAI USA Processes user queries and source code to generate embeddings that improve search functionality when using Sourcegraph AI tools and only when enabled by customer”
SentryotherUSA
“Sentry USA Processes error data, which can include email addresses and other personal data, for debugging purposes”
SparkPostotherUSA
“Sparkpost USA Processes account verification and other service-related emails”

Sources read

DocumentURLReadContent hashLedger
privacy_policyhttps://sourcegraph.com/terms/privacy2026-10-09dc6a5d7350657c13…seq 47760
subprocessorshttps://sourcegraph.com/terms/subprocessors2026-10-091b14b969dc7da09d…seq 47761
dpahttps://sourcegraph.com/terms/dpa2026-10-096140ff76ad1b1284…seq 47762
termshttps://sourcegraph.com/terms/tos2026-10-09853dee03a018d03c…seq 47763
ai_policyhttps://sourcegraph.com/terms/ai-terms2026-10-0935dbb2e77e8727ce…seq 47764
Ledger proof for this record.
seq 47800 · key 2f898a895f05b7a0 · 2026-10-09T05:26:00.999Z
hash 5629e976773e5caef42afbfe79f8c35e37f8ae7641803ff5ad8ad55d67c4cfd6
prev 8638686de060f38c034fc6e2a761b25d25f7bad72468076826be766ca93cfe3e
payload 2fae9edab54c2852599db0922075d11b9db6b776e7f957f4fdbc2e4634805946
signature wHy4VLTU4eTnNJRSdOwuSBMLU8p8Wnq8JeeljZZ9XvBzKCGavsQXL9D3kwK9FN5XlxvRmpaWKCOBF7FSRAD3Bw==
anchored 2026-10-09 at head seq 47827 02fff154a5590e29e572e7ca95b3d866493d5224df1bd81e31d4dfee3d1fbf9e
Fetch /v1/keys; for each ledger entry recompute sha256(prev_hash|kind|ref_id|payload_hash|created_at ISO) and verify the Ed25519 signature over that hash. Anchors are committed to git; compare the anchored head with the chain.