Last updated October 13, 2026
You're deciding whether to point a tool at your source code, so here is the plain-language answer to where that code goes. This page summarizes — and never overrides — the Terms of Service and Privacy Policy; if anything here seems to differ, those documents control.
The CLI uploads your source files, and the index is built and stored by us, per
account and per repository, until you delete it with
sourceindex deinit --force.
Your source files are held only temporarily on our server while a build or search runs, and then deleted. What we keep is the index built from them, not the files.
We don't use your code to train, fine-tune, or evaluate any model, and we don't sell, license, or publish it. Authorized staff can view account records, error reports, log files, and records of your prompts. These records are encrypted at rest and kept only for the periods in the table below.
TLS on every connection. The hosted index is stored with Azure or another third-party cloud provider, using its standard at-rest encryption.
Your repository, and the CLI that uploads files from it.
Our API (Cloudflare) and indexing engine (Azure, East US) build and store the index.
AWS Bedrock, Azure OpenAI, OpenRouter, DeepSeek and TypeSafe. They receive file contents and queries.
After sourceindex init, a background refresher
uploads changed files every 60 seconds, until it has been idle for an hour. Git hooks and
your agent's end-of-turn hook also trigger refreshes, and the CLI upgrades itself from PyPI
at most once an hour. To turn these off, set SOURCEINDEX_NO_AUTO_REFRESH=1
(background refresh) and SOURCEINDEX_AUTO_UPGRADE=0 (self-upgrade).
| What | Where it lives | How long |
|---|---|---|
| Your source code | Your machine; uploaded to our server and held temporarily during builds and searches | Not kept |
| The index | Our Azure storage | Until sourceindex deinit --force; there is no automatic expiry |
| Roadmap output | Returned to your client | Not retained by us |
| Prompts, file contents & responses at model providers (AWS, Microsoft, OpenRouter, DeepSeek, TypeSafe) | Their inference services | Under each provider's own policies (Microsoft documents up to 30 days for abuse monitoring) |
| Usage records (request counts, tokens, cost — no code content) | Our backend | Up to 24 months |
| Error reports (tracebacks; for refused requests also IP address, country and client identifier) | Our backend | Until the problem they report is resolved |
| Log files (sent only when we ask; redacted by default, but we can ask for unredacted logs) | Our backend | Up to 7 days |
Question record (from version 0.2.2): your prompts, up to 8,000 characters each, the absolute repo path, tokens and cost — only for sessions that invoked SourceIndex, sent once a day, used only to check whether SourceIndex is working, and not shared with third parties. Not covered by the telemetry opt-out; turn it off with SOURCEINDEX_RECORD_QUESTIONS=0 | Our backend, encrypted at rest | Up to one month |
| Other uploads: git history (commit hashes, times, and the files and functions each commit touched — no messages or authors), and cross-file reference positions. Each search also sends the absolute repo path, which is not kept | Our backend, with the index | Until sourceindex deinit --force |
Error reports are sent automatically; turn them off with
SOURCEINDEX_ERROR_REPORTING=0.
Your source files are not kept, so there is no stored code to browse. Authorized staff can view the records listed in the table above — account records, error reports, log files and records of your prompts — to run and support the service. Your code is disclosed only to the model providers, and only to serve your request.
AWS Bedrock, Azure OpenAI, OpenRouter, DeepSeek and TypeSafe process file contents and queries to serve your request. AWS and Microsoft state that customer prompts and responses are not used to train their models, and Microsoft documents retaining content for up to 30 days for abuse monitoring, which may include review by their authorized personnel. Each provider's practices are set by its own policies: they can change without notice to us, and we make no representations on their behalf. If this matters to your threat model, read them directly — for example AWS Bedrock data protection and Azure OpenAI data privacy.
No. The CLI selects files by source-language extension, skips
dependency directories, and honors your .gitignore by default, but that is not
a secret filter — an API key sitting inside an uploaded source or config file is
uploaded with the rest of that file and ends up in the hosted index. Keep credentials out
of the files you index, and out of code generally. This is spelled out in
Terms §3(h).
Run sourceindex deinit --force in the repository — it deletes that
repository's hosted index. For your account data, email
[email protected]; there is no
self-service delete tool yet, so we do it by hand.
Not yet — SourceIndex is a small team in private beta, and we won't pretend otherwise. If your security review needs specifics beyond this page — subprocessors, retention, a data processing agreement — email us and you'll get direct answers: [email protected].
Report it to [email protected]. We read every report and we'll respond to serious ones quickly.
This page is a summary written for humans. The complete, binding descriptions of code handling are Terms of Service §§3–5 and Privacy Policy §3.