"We never train on your code" is now table stakes. It is also not the question. The questions are: who stores what, for how long, and which of those stores your key or your bill controls. This post reads the public security pages of three AI review tools as of 2026-08-22, explains what bring-your-own-key (BYOK) does and does not change, and describes how PatchArc handles a provider key when you give it one.
Four things that get conflated
| Term | What it actually governs |
|---|---|
| No training | The vendor and its model providers do not use your data to train models. Says nothing about storage. |
| Zero data retention (ZDR) | The model provider does not keep prompts after responding. Says nothing about the vendor's own database. |
| Vendor retention | What the tool itself stores: diffs, embeddings, indexes, transcripts, and for how long. |
| BYOK | Inference is billed to and routed through your provider account. Changes who sees prompts at the model layer, not what the vendor stores. |
What three vendors publish
CodeRabbit (FAQ, 2026-08-22): code is shared with OpenAI and/or Anthropic for reviewing purposes only; it caches encrypted code and stores vector representations of code; it never trains on customer code; self-hosted Enterprise can opt out of all retention. No BYOK on the public pricing page.
Greptile (security page, 2026-08-22): stores customer code on an encrypted filesystem plus embeddings until GitHub or GitLab access is revoked; uses OpenAI and Anthropic APIs; customers can bring their own LLM; SOC 2 Type II.
Sourcery (trust page, 2026-08-22): does not retain code after a review; OpenAI and Anthropic; SOC 2 Type 2; bring-your-own-LLM on the Team tier and up.
Three honest postures, three different footprints. Greptile's is largest by design (a full index is the product). Sourcery's is smallest. CodeRabbit sits between. None of these are criticisms; they are the trade you make for what each tool does.
What BYOK changes
With BYOK, prompts go to your provider account under your provider's terms, including whatever ZDR agreement you have with that provider. Your bill is your bill. That is real. What BYOK does not change: the vendor still has to construct the prompt, which means the vendor still processes (and possibly stores) the code that goes into it. BYOK moves the model layer; it does not move the vendor layer.
The corollary: if a vendor stores an index of your repository, BYOK does not shrink that index.
How PatchArc stores a key
PatchArc's local review needs no model at all; it is computed from recorded evidence. AI summaries are an optional layer, and in 0.2.0 they are not generated yet, so what follows describes the key plumbing that exists today, not a feature you can switch on.
- You send a provider key once to
POST /v1/ai/connectionsover TLS. - The API forwards it to a key-broker worker that has no public route; it is reachable only by service binding.
- The broker generates a per-connection AES-256-GCM data-encryption key, encrypts your provider key with it, then wraps the DEK with a versioned key-encryption key that only the broker holds.
- Ciphertext, both nonces, and the KEK version are stored. Plaintext exists only in the broker's memory during a single resolution call.
No API returns the key. GET /v1/ai/connections returns metadata only. Revocation is a soft delete. The key-broker source is in the repository (workers/src/key-broker.ts) if you want to read it rather than take our word.
The part most vendors skip: what never leaves
The strongest privacy property a code tool can have is that the sensitive step happens on your machine. PatchArc's capture, review, seal, and verify all run locally with no network; the only upload is the capsule you explicitly share, and the cloud re-verifies it rather than reading your repository. That is a different category from "we store it carefully."
Questions to ask any vendor
- What do you store, and is it the diff, the repository, or an index of it?
- For how long, and what revokes it?
- Which model providers, and do you have ZDR with them?
- If I bring my own key, what do you still store?
- Can I read the code that handles my key?
The alternatives page has the pricing and self-hosting columns for the same three vendors, dated.