Skip to content

[TEC-616] Update multimodal data privacy documentation #2707

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
abhijna merged 6 commits into from
Jul 21, 2026
+22 −21
Merged

[TEC-616] Update multimodal data privacy documentation #2707

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
f908e97
remove data storage statement
abhijna Jul 10, 2026
e2ba50b
data privacy docs wording update
abhijna Jul 14, 2026
2888e6b
typo fixes
abhijna Jul 14, 2026
839d260
Update docs/semgrep-multimodal/privacy.mdx
abhijna Jul 21, 2026
04bc292
Update docs/semgrep-multimodal/privacy.mdx
abhijna Jul 21, 2026
77e7779
chore: regenerate docs from build scripts
khorne3 Jul 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions docs/extensions/pre-commit.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ Add the following to your `.pre-commit-config.yaml` file:
```yaml
repos:
- repo: https://github.com/semgrep/pre-commit
rev: 'v1.169.0'
rev: 'v1.170.0'
hooks:
- id: semgrep
entry: semgrep
Expand Down Expand Up @@ -51,7 +51,7 @@ Add the following to your `.pre-commit-config.yaml` file:
```yaml
repos:
- repo: https://github.com/semgrep/pre-commit
rev: 'v1.169.0'
rev: 'v1.170.0'
hooks:
- id: semgrep-ci
```
Expand Down
39 changes: 20 additions & 19 deletions docs/semgrep-multimodal/privacy.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ Semgrep Multimodal’s data privacy and legal considerations apply across the fo
When using Semgrep AI features:

1. Semgrep accesses repository code on a file-by-file basis. In limited cases, broader repository access may be required.
1. Relevant data, including portions of source code, are sent outside your repository to AI subprocessors for analysis. Semgrep supports AI subprocessors from the following model vendors:
1. Relevant data, including portions of source code, is sent outside your repository to AI subprocessors for analysis. Semgrep supports AI subprocessors from the following model vendors:
- OpenAI (default)
- Amazon Bedrock (default)
- Anthropic (BYOK; not available for AI-powered detection scans)
Expand Down Expand Up @@ -44,38 +44,38 @@ Semgrep maintains Data Protection Agreements (DPAs) with all AI subprocessors. C

## Data retention and storage by Semgrep

Semgrep stores a limited amount of your data to support product functionality and performance evaluation. The type of data stored depends on the feature being used.
Semgrep stores some of your data to support product functionality and performance evaluation. The type of data stored depends on the Semgrep feature you use.

### Triage and remediation
### Finding remediation

Data stored may include:
- Finding metadata, including severity, repository, file path, and line number
- Remediation guidance

- AI prompts and responses
- Code snippets associated with findings
- Minimal surrounding context required for accurate results
This data is retained indefinitely unless otherwise noted. Customers can request that account data be deleted by [contacting Support](/support)

### Memories

Includes all data from triage and remediation, and adds:

Includes all data from findings remediation, and adds:
- User-defined Memory content that is stored as text
- Code snippets included in Memories
- User-defined code snippets provided in Memories

Semgrep does not retrieve or access external data sources referenced in Memories.

### AI-powered detection scans
This data is retained indefinitely unless otherwise noted. Customers can request that account data be deleted by [contacting Support](/support).

Data stored may include:
### Detection source data

Data stored may include:
- AI prompts and responses
- Code snippets and, where required, full file contents
- Uploaded context documentation
- Scan reports, including metadata such as file names and, in some cases, code snippets

Uploaded context documentation and scan reports are persistently stored in a Semgrep-managed Amazon S3 bucket. Context documentation may be reused across scans.
Uploaded context documentation and scan reports are persistently stored in a Semgrep-managed Amazon S3 bucket. Context documentation may be reused in future scans.

Source data is retained for up to 6 months unless otherwise noted. Semgrep will provide at least 30 days' notice before making changes to retention policies.

### Retention period
Stored data is retained for up to 6 months, unless otherwise noted. Semgrep will provide at least 30 days’ notice before making changes to retention policies.

### Purpose of storage

Expand All @@ -88,9 +88,9 @@ Stored data is used to:

## Data handling and protections
- Customer data is logically isolated and never commingled across tenants
- Semgrep does not intentionally send personal data to AI subprocessors
- Semgrep does not intentionally send personal data to AI model vendors
- Semgrep and its subprocessors do not obtain ownership rights to your source code
- Data sent to AI subprocessors is deleted after processing in accordance with zero data retention agreements
- Data sent to AI model vendors is deleted after processing in accordance with zero data retention agreements


## Minimal data retention policy (optional)
Expand All @@ -116,8 +116,9 @@ The table below compares default data handling with the minimal data retention p
| Category | Default behavior | Minimal data retention policy |
| :--- | :--- | :--- |
| AI prompts and code | May be logged and stored to support functionality and performance evaluation | Not logged or captured by observability tools; not stored in external systems, and persistence is limited to what is required for functionality |
| AI responses | Stored for up to 6 months to provide functionality and access to prior results | Stored only as required to provide functionality, with reduced persistence |
| Memories | Stored within Semgrep-managed systems and may include user-provided content and small code snippets | No change |
| AI responses (triage and remediation) | Stored for the lifetime of the finding and account | Stored only as required to provide functionality, with reduced persistence |
| AI responses (other features) | Stored for up to 6 months to provide functionality and access to prior results | Stored only as required to provide functionality, with reduced persistence |
| Memories | Stored for the lifetime of the account; may include user-provided content and small code snippets | No change |
| AI-powered detection data | Full file analysis, context documentation, and scan reports may be stored and reused | No change |
| External storage (Semgrep-managed S3) | Used for certain data | Not used, except for AI-powered detection context documents and scan reports |
| Data deletion | Available upon request | Available upon request |
Expand All @@ -127,7 +128,7 @@ The table below compares default data handling with the minimal data retention p
Under the minimal data retention policy, the following behavior remains unchanged for AI-powered detection scans:

- If you upload context documentation to enhance AI-powered detection scans, these files are persistently stored in a Semgrep-managed Amazon S3 bucket to enable reuse across future AI-powered detection scans.
- AI-powered scan reports are stored in a Semgrep-managed Amazon S3 bucket. These reports may contain metadata such as file names and, in some cases, code snippets included in issue descriptions.
- AI-powered detection scan reports are stored in a Semgrep-managed Amazon S3 bucket. These reports may contain metadata such as file names and, in some cases, code snippets included in issue descriptions.

Responses from Semgrep's AI model vendors are stored in the Semgrep database solely for providing Multimodal functionality. For instance, AI-generated remediation advice is stored so users can access it in the Semgrep AppSec Platform. However, code snippets are never retained to improve future prompts.

Expand Down
Loading