Every time you press Tab in Cursor or ask Claude Code to fix a bug, your code travels somewhere. Here’s exactly where it goes for each tool.
The data flow
Your code → Internet → Provider's servers → Model inference → Response → Your IDE
↓
Logged? Stored? Used for training?Provider-by-provider breakdown
Anthropic (Claude Code, Claude API)
- Where: US servers (AWS)
- Retention: 30 days (API), longer for consumer
- Training: ❌ Not on API data. ⚠️ Consumer data may be used
- DPA: Available for Team/Enterprise plans
OpenAI (Codex CLI, ChatGPT, API)
- Where: US servers (Azure)
- Retention: 30 days (API), longer for consumer
- Training: ❌ Not on API data (since March 2023). ⚠️ ChatGPT data may be used unless opted out
- DPA: Available for business plans
Google (Gemini CLI, Vertex AI)
- Where: Configurable (US, EU, Asia)
- Retention: Configurable
- Training: ❌ Not on Vertex AI data. ⚠️ Free Gemini may be used
- DPA: Available for Cloud customers
Mistral (Vibe CLI, La Plateforme)
- Where: EU servers (France)
- Retention: Per DPA terms
- Training: ❌ Not on API data
- DPA: Available, EU-native
Self-hosted (Ollama, vLLM)
- Where: Your machine/server
- Retention: You control it
- Training: ❌ Impossible — model runs locally
- DPA: Not needed
The risk matrix
| Scenario | Risk level | Why |
|---|---|---|
| Personal project with Cursor | 🟢 Low | No sensitive data |
| Startup using Claude API | 🟡 Medium | Need DPA, review terms |
| Enterprise with customer PII in code | 🔴 High | Need DPA + audit + possibly EU hosting |
| Healthcare/finance codebase | 🔴 High | Regulatory requirements beyond GDPR |
| Using free ChatGPT for work code | 🔴 High | No DPA, data may be used for training |
What to do
For personal projects: Use whatever you want. The risk is minimal.
For company code:
- Use API access (not consumer subscriptions)
- Get a DPA from your provider
- Consider Mistral for EU data residency
- Or self-host for maximum control
For regulated industries: Self-host with Ollama + Devstral Small or Qwen 3.5. No data leaves your network.
Related: AI and GDPR for Developers · Best AI Coding Agents for Privacy · Self-Hosted AI for GDPR