Does Sonar AI CodeFix has more details on how it manages users' code?

[thu (Théo)]

Hello,

As a SonarQube Cloud user, I noticed that there was an hint added on my SonarQube page to try AI CodeFix.

Is there any details on how Sonar stores its user data ? The mention of “Input Data” in the TOS is not clear and it seems that we cannot opt-out of sending snippets of code and metadata. For users inside the UE, is it specified that the data is sent outside of the territory ?
Also, if an external provider is used (such as OpenAI, Anthropic or another), is the sharing of snippets of code used “improving analysis” ?

Best regards,
Théo

[ganncamp (G Ann Campbell)]

Hi Theo,

Welcome to the community (and sorry about the missing accent. AmE keyboard )!

@thu

it seems that we cannot opt-out of sending snippets of code and metadata

Well, no. That’s how AI CodeFix works - it sends snippets of code off to AI to get the fix. No snippet sending, no fix.

@thu

For users inside the UE, is it specified that the data is sent outside of the territory ?

You have the option to select a self-hosted LLM. You then control the “where” completely.

@thu

Also, if an external provider is used (such as OpenAI, Anthropic or another), is the sharing of snippets of code used “improving analysis” ?

From the docs:

Service agreements with Sonar’s LLMs prevent your code from being used to train those models.

 
HTH,
Ann