Last updated August 6, 2026
You're deciding whether to point a tool at your source code, so here is the plain-language answer to where that code goes. This page summarizes — and never overrides — the Terms of Service and Privacy Policy; if anything here seems to differ, those documents control.
Everything SourceIndex builds from your repository is written to
.sourceindex/ inside your repo. We don't host, mirror,
or retain a copy. Deleting that folder deletes the index; you never have to ask us.
Source files pass through our backend in memory, for the duration of one request, and are discarded when the response returns. Nothing is written to persistent storage under our control.
We don't use your code to train, fine-tune, or evaluate any model, and no SourceIndex personnel reads it in the ordinary course of running the service. We don't sell it, license it, or publish it.
TLS on every connection. The local index is encrypted at rest with AES-256-GCM — both file contents and file paths — with the key held in your OS keychain where available.
Your repository, and the index the CLI builds from it
(.sourceindex/, encrypted).
A transit and orchestration layer: routes your files to the inference providers and returns the result. Code exists here in memory only, per request.
Model inference (AWS Bedrock, Azure OpenAI). Both state they do not train on customer prompts or responses.
The roadmap travels back the same way — provider → our backend (in memory) → your client — and lands in the local index. Nothing else moves, and nothing moves at all until you run the CLI against a repository.
| What | Where it lives | How long |
|---|---|---|
| Your source code | Your machine; transits our backend in memory per request | Not stored by us |
| The index | Your machine only (.sourceindex/, encrypted) | Until you delete it |
| Roadmap output | Returned to your client | Not retained by us |
| Prompts & responses at AWS / Microsoft | Their inference services | Limited abuse-monitoring retention under their own policies (Microsoft documents up to 30 days) |
| Operational metadata (request counts, tokens, cost — no code content) | Our backend | Up to 24 months |
| Failure diagnostics (may incidentally include file paths) | Our backend | Up to 7 days |
No one here reads or reviews customer code in the ordinary course of providing the service, and the design backs that up: there is no stored code to browse. The only disclosure is to the two inference providers, and only to serve your request.
Both state that customer prompts and responses are not used to train their models. Their published policies permit retaining content for a limited period for abuse monitoring — Microsoft documents up to 30 days, which may include review by their authorized personnel. Those are their policies: they can change without notice to us, and we make no representations on their behalf. If this matters to your threat model, read them directly: AWS Bedrock data protection and Azure OpenAI data privacy.
No. The CLI selects files by source-language extension and skips dependency directories, but that is not a secret filter — an API key sitting inside an indexed source or config file is uploaded with the rest of that file. Keep credentials out of the file types you index, and out of code generally. This is spelled out in Terms §3(h).
Delete .sourceindex/ from your repo — the index is gone, and there
is no server-side copy to chase. We never had your code to delete. The small amount
of operational metadata tied to your access key can be deleted on request:
[email protected].
Not yet — SourceIndex is a small team in private beta, and we won't pretend otherwise. The architecture is the mitigation in the meantime: code that is never written to storage can't leak from storage, and an index that never leaves your machine isn't ours to lose. If your security review needs specifics beyond this page — subprocessors, retention, a data processing agreement — email us and you'll get direct answers: [email protected].
Report it to [email protected]. We read every report and we'll respond to serious ones quickly.
This page is a summary written for humans. The complete, binding descriptions of code handling are Terms of Service §§3–5 and Privacy Policy §3.