CodeAnt AI

GDPR overview

GDPR implementation is documented, not merely asserted. The demo page states "SOC 2, GDPR compliant", and a dedicated Data Processing Agreement is published and billed as GDPR-ready. It defines controller, processor and processing by direct reference to Regulation 2016/679, incorporates controller-to-processor and processor-to-processor standard contractual clauses for transfers to third countries, commits CodeAnt AI to assist with data-subject requests through the service controls, requires notification of security incidents without undue delay, and promises audit reports from an annual independent audit under ISO 27001 or an equivalent standard — a contractual audit commitment, not a certification the vendor holds. Two gaps stand out: no Article 27 EU representative is named and no EU address is given; and the privacy policy itself never mentions the GDPR, saying only that using the service implies consent to transfers outside your country of residence. Services are not intended for under-16s.

Who owns the data?

Under its Data Processing Agreement, CodeAnt AI, Inc. acts as a processor on the customer's instructions, while the customer stays controller of the repository data it submits. The trust centre states the code is never stored: each scan runs in an isolated, ephemeral environment. Customers can request the return or deletion of their data through the service controls at any time and for up to 90 days after termination, and can delete it from CodeAnt's network themselves. One licence runs the other way: CodeAnt AI may display a customer's name and logo in its marketing, revocable in writing to contact@codeantai.com within twenty business days. Formal notices go to support@codeant.ai.

Reuse rights

CodeAnt AI states plainly that it does not train on customer code: the models it serves are trained only on publicly available data, and LLM requests are ephemeral, processed in memory and neither logged nor retained by CodeAnt AI or by its model provider. Access is limited to the data that code review, quality and security analysis actually require, and nothing beyond. The findings, reports and suggested fixes the platform produces are the customer's to use inside its own engineering and audit workflows without asking permission. On the vendor's side, personal data serves to deliver and improve the service, fight fraud, communicate with users, meet legal obligations and measure traffic through Google Analytics; the privacy policy rules out sharing with third parties for direct marketing without consent and states that Do Not Track signals have no declared effect. Subprocessors are covered by a general authorisation, with a published list and thirty days' notice before a new one is added — notice a customer can object to by terminating, stopping the affected service, or having its data moved to another Region.

Data retention & training

Hosting summary

CodeAnt AI, Inc. is a United States company headquartered at 355 Bryant St, San Francisco, and its privacy policy states that using the service implies consent to information being transferred outside your country of residence, including to the United States. The trust centre publishes a subprocessor list: GCP, AWS and Microsoft Azure for IT infrastructure, plus Stripe, HubSpot, Slack and eight others. The three infrastructure subprocessors are declared as processing in the United States, the United Kingdom and India. For GDPR-covered data going to a third country, the DPA relies on standard contractual clauses, and it lets a customer objecting to a new subprocessor have its data moved to another Region. The trust centre also states that code is not stored at all: scans run in isolated, ephemeral environments and LLM requests are handled in memory and never logged. Enterprise customers can deploy inside their own AWS, GCP or Azure VPC, or entirely on-premises, where no data ever leaves their network. One technical caveat: the public IP the domain resolves to is an anycast CDN node in Amsterdam — content delivery, not a data-hosting jurisdiction.