Who Trains on Your Code?
Copilot, Cursor, Claude, ChatGPT

“Is it secure?” is the question that gets asked, and it is the wrong shape. A vendor can answer it with a compliance page full of acronyms, and nothing on that page tells you whether the diff you just pasted is now someone’s training data.

Three narrower questions have checkable answers. Does the vendor train on what you send? How long does it sit on their servers — and who can force it to sit there longer? And which of those answers change when someone pays for the business tier? This piece answers all three for the four tools this site’s readers actually use: GitHub Copilot, Cursor, Claude, and ChatGPT with the OpenAI API.

The one-screen version

One pattern is worth naming before the details: at every vendor here, the consumer default is the vendor-friendly one, and the paid-organization default is the customer-friendly one. That asymmetry, more than any feature, is the story of this table.

Tool by tool

GitHub Copilot: the clean split

Copilot has the easiest policy to summarize because it splits exactly along who pays. On the individual plans — Free, Pro, Pro+ — GitHub may use your prompts, the suggestions you were shown, and code snippets from your sessions to train and improve its models. There is an opt-out in your Copilot settings, and GitHub says switching it off costs you nothing in features. But it is an opt-out, and it is on you to have found it.

On Copilot Business and Enterprise the language stops hedging entirely: “GitHub does not use either Copilot Business or Enterprise data to train its models.” Not a toggle — a term of the product.

Retention follows the same spirit. For code completions and chat inside the IDE, prompts and suggestions are not retained at all — they exist to produce the answer and are gone. The web, mobile, and CLI surfaces keep conversation threads for 28 days, because thread history is the feature there. And on the organization tiers GitHub adds the thing security reviews actually ask for: IP indemnification for unmodified suggestions when the duplicate-code filter is on.

Cursor: Privacy Mode is the product

Cursor deserves closer reading than the others for a structural reason: an AI editor only works by reading a lot of your codebase. Its answer is Privacy Mode, and to Cursor’s credit it is available on every plan, including free. With it on, Cursor says it will not train on your data, and it backs that with zero-data-retention agreements with its model providers — OpenAI and Anthropic among them — so the models answering your requests are contractually barred from keeping them.

With Privacy Mode off, the policy reads very differently: Cursor “may use and store codebase data, prompts, editor actions, code snippets, and other code data” to improve features and train its models. That is a difference in kind, not degree — your employer’s code improving someone else’s product. The setting lives at Settings → General → Privacy Mode; on business plans it is on by default, admin-enforced, and inherited by new team members, which is precisely what a company should want from it.

Three pieces of fine print worth knowing before your security team finds them for you. Requests transit Cursor’s backend even when you plug in your own API keys — the keys change who bills you, not who routes you. Codebase indexing stores embeddings and metadata even in Privacy Mode; the plaintext is deleted after each request, but the derived vectors persist, and “derived from your source” is a phrase reviewers notice. And like every provider here, abuse classifiers can hold a flagged prompt for investigation regardless of mode. Cursor is SOC 2 Type II attested, with the report available on request.

Claude: the September 2025 flip

For years Anthropic’s consumer default was the quietly good one: no training on your conversations. On September 28, 2025 that changed. Users on Free, Pro, and Max now choose whether their chats and coding sessions may train models — and the consent dialog arrived as a large Accept button with the training toggle pre-set to allow. Accepting without reading meant opting in, and opting in extends retention from 30 days to five years.

The part developers keep missing: Claude Code counts. If you run Claude Code under a Pro or Max subscription, those sessions fall under the same consumer toggle. The exclusions are exactly the commercial surfaces — Claude for Work (Team and Enterprise), the API, Bedrock, Vertex AI, Education, and Government — none of which are trained on, toggle or no toggle.

If you have a consumer Claude account and never deliberately made this choice, the setting is at Settings → Privacy. It takes ten seconds to check, and it applies to new and resumed sessions from the moment you change it. The episode is also this piece’s best argument for its own date stamp: the policy you verified in 2024 was not the policy by October 2025. Defaults are not stable; contracts are.

ChatGPT and the OpenAI API: deleted is a policy, not physics

OpenAI’s split is the familiar one by now. Consumer ChatGPT — Free, Plus, Pro — ships with “improve the model for everyone” switched on, and the opt-out is yours to find in Data Controls. ChatGPT Team, Enterprise, Edu, and the API are not used for training by default. API inputs and outputs are retained for up to 30 days for abuse monitoring, then deleted — and customers with qualifying use cases can request zero data retention on eligible endpoints, under which prompts and outputs are simply never stored.

Then 2025 demonstrated what retention policy is worth under litigation. In the New York Times copyright suit, a federal court ordered OpenAI to preserve ChatGPT output logs — including chats users had deleted — and the order was affirmed in June 2025 over OpenAI’s privacy objections. By OpenAI’s own account the hold covered consumer tiers and standard API traffic, while ChatGPT Enterprise, Edu, and zero-data-retention API customers sat outside it. The blanket forward-looking hold ended that September; data already preserved stayed preserved, and in November the court ordered 20 million de-identified conversations produced to the plaintiffs.

What the business tier actually buys

Line the four vendors up and the business tiers converge on the same four moves. Training is off by contract, not by toggle. Settings are admin-enforced, so no individual developer can quietly undo them. Retention is short or zero, with ZDR available where it matters. And there is paper — a DPA, a SOC 2 report, audit logs — that lets a security review end in “yes” instead of “it depends who configured it.”

Which means “which AI platform is secure” is mostly a malformed question. The real comparison is not Copilot versus Cursor versus Claude — it is consumer plan versus business plan of any of them. The vendor matters less than the tier.

What I’d actually do

On your own projects: use whatever you like, and spend the two minutes flipping the toggles if you care where your side projects end up: Copilot’s training opt-out in your GitHub settings, Cursor’s Privacy Mode, Claude’s Settings → Privacy toggle, ChatGPT’s Data Controls.

On employer code: the tool your company approved, on the tier it approved, and nothing else — not because consumer tools are sinister, but because the plan-level guarantees are the thing your company can point at when someone asks. No approved tool at your company yet? That is an argument worth having, and the table above is the shape of it.

If you are the one choosing for a team: get four things in writing — a no-training clause, a retention number (zero if the vendor offers it), admin enforcement, and the SOC 2 report. Every platform on this page can pass that bar on the right tier, which is the quiet good news of the whole comparison.