diff --git a/docs/extensions/pre-commit.mdx b/docs/extensions/pre-commit.mdx index 0b5167006f..c470e87ed0 100644 --- a/docs/extensions/pre-commit.mdx +++ b/docs/extensions/pre-commit.mdx @@ -18,7 +18,7 @@ Add the following to your `.pre-commit-config.yaml` file: ```yaml repos: - repo: https://github.com/semgrep/pre-commit - rev: 'v1.169.0' + rev: 'v1.170.0' hooks: - id: semgrep entry: semgrep @@ -51,7 +51,7 @@ Add the following to your `.pre-commit-config.yaml` file: ```yaml repos: - repo: https://github.com/semgrep/pre-commit - rev: 'v1.169.0' + rev: 'v1.170.0' hooks: - id: semgrep-ci ``` diff --git a/docs/semgrep-multimodal/privacy.mdx b/docs/semgrep-multimodal/privacy.mdx index 92c56b6807..1fe41f8507 100644 --- a/docs/semgrep-multimodal/privacy.mdx +++ b/docs/semgrep-multimodal/privacy.mdx @@ -13,7 +13,7 @@ Semgrep Multimodal’s data privacy and legal considerations apply across the fo When using Semgrep AI features: 1. Semgrep accesses repository code on a file-by-file basis. In limited cases, broader repository access may be required. -1. Relevant data, including portions of source code, are sent outside your repository to AI subprocessors for analysis. Semgrep supports AI subprocessors from the following model vendors: +1. Relevant data, including portions of source code, is sent outside your repository to AI subprocessors for analysis. Semgrep supports AI subprocessors from the following model vendors: - OpenAI (default) - Amazon Bedrock (default) - Anthropic (BYOK; not available for AI-powered detection scans) @@ -44,38 +44,38 @@ Semgrep maintains Data Protection Agreements (DPAs) with all AI subprocessors. C ## Data retention and storage by Semgrep -Semgrep stores a limited amount of your data to support product functionality and performance evaluation. The type of data stored depends on the feature being used. +Semgrep stores some of your data to support product functionality and performance evaluation. The type of data stored depends on the Semgrep feature you use. -### Triage and remediation +### Finding remediation Data stored may include: +- Finding metadata, including severity, repository, file path, and line number +- Remediation guidance -- AI prompts and responses -- Code snippets associated with findings -- Minimal surrounding context required for accurate results +This data is retained indefinitely unless otherwise noted. Customers can request that account data be deleted by [contacting Support](/support) ### Memories -Includes all data from triage and remediation, and adds: - +Includes all data from findings remediation, and adds: - User-defined Memory content that is stored as text -- Code snippets included in Memories +- User-defined code snippets provided in Memories Semgrep does not retrieve or access external data sources referenced in Memories. -### AI-powered detection scans +This data is retained indefinitely unless otherwise noted. Customers can request that account data be deleted by [contacting Support](/support). -Data stored may include: +### Detection source data +Data stored may include: - AI prompts and responses - Code snippets and, where required, full file contents - Uploaded context documentation - Scan reports, including metadata such as file names and, in some cases, code snippets -Uploaded context documentation and scan reports are persistently stored in a Semgrep-managed Amazon S3 bucket. Context documentation may be reused across scans. +Uploaded context documentation and scan reports are persistently stored in a Semgrep-managed Amazon S3 bucket. Context documentation may be reused in future scans. + +Source data is retained for up to 6 months unless otherwise noted. Semgrep will provide at least 30 days' notice before making changes to retention policies. -### Retention period -Stored data is retained for up to 6 months, unless otherwise noted. Semgrep will provide at least 30 days’ notice before making changes to retention policies. ### Purpose of storage @@ -88,9 +88,9 @@ Stored data is used to: ## Data handling and protections - Customer data is logically isolated and never commingled across tenants -- Semgrep does not intentionally send personal data to AI subprocessors +- Semgrep does not intentionally send personal data to AI model vendors - Semgrep and its subprocessors do not obtain ownership rights to your source code -- Data sent to AI subprocessors is deleted after processing in accordance with zero data retention agreements +- Data sent to AI model vendors is deleted after processing in accordance with zero data retention agreements ## Minimal data retention policy (optional) @@ -116,8 +116,9 @@ The table below compares default data handling with the minimal data retention p | Category | Default behavior | Minimal data retention policy | | :--- | :--- | :--- | | AI prompts and code | May be logged and stored to support functionality and performance evaluation | Not logged or captured by observability tools; not stored in external systems, and persistence is limited to what is required for functionality | -| AI responses | Stored for up to 6 months to provide functionality and access to prior results | Stored only as required to provide functionality, with reduced persistence | -| Memories | Stored within Semgrep-managed systems and may include user-provided content and small code snippets | No change | +| AI responses (triage and remediation) | Stored for the lifetime of the finding and account | Stored only as required to provide functionality, with reduced persistence | +| AI responses (other features) | Stored for up to 6 months to provide functionality and access to prior results | Stored only as required to provide functionality, with reduced persistence | +| Memories | Stored for the lifetime of the account; may include user-provided content and small code snippets | No change | | AI-powered detection data | Full file analysis, context documentation, and scan reports may be stored and reused | No change | | External storage (Semgrep-managed S3) | Used for certain data | Not used, except for AI-powered detection context documents and scan reports | | Data deletion | Available upon request | Available upon request | @@ -127,7 +128,7 @@ The table below compares default data handling with the minimal data retention p Under the minimal data retention policy, the following behavior remains unchanged for AI-powered detection scans: - If you upload context documentation to enhance AI-powered detection scans, these files are persistently stored in a Semgrep-managed Amazon S3 bucket to enable reuse across future AI-powered detection scans. -- AI-powered scan reports are stored in a Semgrep-managed Amazon S3 bucket. These reports may contain metadata such as file names and, in some cases, code snippets included in issue descriptions. +- AI-powered detection scan reports are stored in a Semgrep-managed Amazon S3 bucket. These reports may contain metadata such as file names and, in some cases, code snippets included in issue descriptions. Responses from Semgrep's AI model vendors are stored in the Semgrep database solely for providing Multimodal functionality. For instance, AI-generated remediation advice is stored so users can access it in the Semgrep AppSec Platform. However, code snippets are never retained to improve future prompts.