Seven reviewers, what each documents
Cells condense the vendor's own documented claim, with the evidence-row id (L#, folded from the 2026-11-01 data-flow pass) for the quote, URL, and retrieval date. "not documented" means no official statement was found this session; it is not evidence of absence in the product, only in the paperwork.
| Tool | Retention (documented) | Training use | Permissions documented | Self-host / VPC | Model providers named |
|---|---|---|---|---|---|
| GitHub Copilot code reviewfirst-party | No feature-specific retention table; points to a JavaScript-only trust center (L132) | Free/Pro/Pro+: opt-out training from 2026-04-24; Business/Enterprise excluded; Azure Repos review interaction data not used for foundation-model training (L134, L138) | First-party bot, no grant exists; default Comment review, approvals configurable (L140, L141) | No; self-hosted Actions runners host agentic capabilities only (L129) | Not documented; "carefully tuned mix", model switching unsupported (L139) |
| CodeRabbitSaaS | Review cache max 7 days, encrypted; vector embeddings and Learnings stored until org opt-out; US servers (L146, L147, L150) | Never on customer code, including its model providers; OSS repos ARE training data (L152) | Full GitHub App scope incl. workflow write; auto-approve bounded by org risk limits (L153, L154) | Enterprise self-hosted; full retention opt-out there (L148) | "OpenAI and/or Anthropic" for reviewing purposes only (L144) |
| QodoSaaS + enterprise | 48-hour log retention per enterprise page; retention for repo and PR-history indexes not documented (L156, L159) | No training on customer code per enterprise page; a 2024 blog implied free-tier data was not covered (L159, L161) | Not itemized in product docs; installation runs through a portal wizard | Single-tenant VPC, on-premises, air-gapped, BYOK (L157, L160) | Anthropic, OpenAI, Google, DeepSeek; BYO or self-hosted models incl. Nemotron (L160) |
| GreptileSaaS + self-host | Code cached until host access revoked, then deleted; org deletion hard-deletes in 24h, backups within 30 days (L162, L164) | De-identified data MAY train models by default; admin opt-out; self-hosted: no ML unless configured (L165) | Connection mechanics documented; no scope table (L166) | True self-host: Docker Compose or Helm, BYO-LLM (L168) | Named only on a JavaScript-gated trust center (L163) |
| Cursor Bugbotrides Cursor platform | Server file cache "temporary", encrypted, no number; all requests traverse Cursor's backend (L172) | Privacy Mode on: no training, ZDR with all providers; off: may train on codebase data and prompts (L173, L174) | Full GitHub App table; clone-level repository access (L176) | No; PrivateLink and Cloudflare Tunnel cover connectivity, not computation (L178) | Providers under ZDR agreements; abuse-classifier storage exception documented (L173) |
| GraphiteGitHub-only | Code indexing opt-in, deleted within 30 days of disable; review-log retention not documented (L183) | No training by Graphite or subprocessors; data reaches AI features only after explicit approval (L181, L182, L184) | Full GitHub App table incl. merge rights (L179, L185) | No; GitHub Enterprise Server connectivity documented for Enterprise (L186) | Anthropic and OpenAI subprocessors under no-training terms (L181) |
| Ellipsisagent platform | Session TTL 0 hours to 1 year, customer-set; deletion within 4h of expiry; operational data max 3 days (L188) | No training on source code; model-provider agreements prohibit it; customer picks the harness and model (L191) | Per-session YAML-scoped tokens, hour-lived install tokens, "anything not listed is denied" (L192, L193) | Private AWS VPC; bring-your-own-cloud offered (L195) | Customer-chosen (Claude Code, Codex, Gemini CLI harnesses) (L191) |
Graphite's docs now route trust inquiries to Cursor's trust portal (L187); the acquisition itself is third-party-reported, not vendor-announced, and is stated here only as the docs' own pointer.
Where the documented postures actually differ
Every vendor now publishes a no-train commitment for paying customers' code. The tiers differ in three places that matter. First, GitHub's individual plans flip to opt-out training on interaction data from April 24, 2026, while Business and Enterprise tiers are excluded - a plan-level, not policy-level, boundary (L134). Second, CodeRabbit's no-training promise explicitly excludes open-source repositories, which it uses to train its systems; public-repo maintainers are in a different consent position than customers (L152). Third, Greptile may train on de-identified customer data by default, with an admin opt-out - a materially weaker default than the others', and none of the third-party reviewers documents whether the de-identification is audited (L165).
On permissions, only Cursor and Graphite publish GitHub App scope tables (L176, L179). CodeRabbit documents its scope inside an install guide (L153). GitHub's first-party reviewer publishes no scope at all because no grant exists; its effective capabilities must be assembled from three pages (L140-L142). Graphite's write scope includes contents, pull requests, and workflows - merge rights, a broader footprint than a review-only bot needs (L185).
Against attacker-controlled PR text, the entire set yields exactly two documented content-level defenses: GitHub's hidden-character filtering plus a default-on egress firewall for the review agent (L142), and Ellipsis's per-session tokens scoped so the limit "holds even against a prompt injection" (L193). CodeRabbit, Greptile, Cursor Bugbot, Graphite, and Qodo document nothing about how review prompts treat attacker-controlled text. How each vendor's reviewer treats the untrusted input that is the PR itself remains, across the board, unpublished.
The absences, held to the same standard as the claims
No vendor publishes a retention table for the review interactions themselves: prompts, model responses, review comments as stored server-side. GitHub's own FAQ admits no feature-specific table exists (L132); CodeRabbit bounds only the cache at 7 days (L146); Ellipsis is the only vendor with a numeric, customer-controlled TTL including a zero-hour option (L188); Graphite bounds only its opt-in index at 30 days (L183); Cursor says "temporary" with no number (L172).
What happens to embeddings, indexes, learned rules, and learned memory when the app is removed is documented only by CodeRabbit (knowledge-base opt-out is immediate and irrevocable, L148), Graphite (index deletion within 30 days, L183), and Greptile (code deleted when host access is revoked, L162). The rest are silent.
Nobody names the models that process a given review. GitHub refuses by design (L139); CodeRabbit says "OpenAI and/or Anthropic" (L144); Graphite names subprocessors but not models (L181); Ellipsis is the exception where the customer picks the harness and model, making the data path fully customer-determined (L191).
The trust centers that hold subprocessor lists, retention details, and audit reports increasingly render only in browsers: Copilot's, CodeRabbit's, Qodo's, Cursor's, and Greptile's all render as JavaScript applications or gate documents behind request forms. The mechanical facts a buyer needs sit behind interfaces a static audit cannot reach, and Graphite now delegates its trust content to Cursor's portal entirely (L133, L187).
Method. This page condenses the 2026-11-01 data-flow pass: official documentation, security pages, privacy notices, DPAs, trust centers, changelogs, and status pages only, fetched 2026-11-01. Marketing claims about detection quality are out of scope and live (quarantined) on the evidence page. Some trust-center contents could not be captured statically and are listed in the underlying ledger as open items rather than papered over.