C:\> security

Security & trust

Codepanion gives your support team read access to your codebase and production database, so we hold ourselves to the bar that access demands. Here is how we handle your data, who our subprocessors are, and how to report a vulnerability.

The #1 question

We never train models on your data

Your code, your data, and your conversations are never used to train any AI model — ours or anyone else's. Codepanion uses your data only to answer the questions your team asks, within your own tenant.

The agent runs on Azure OpenAI (Azure AI Foundry). Microsoft is contractually committed to not using your prompts or the model's responses to train, retrain, or improve any of its models, and does not share them with other customers or with OpenAI. Azure OpenAI runs inside Microsoft's own Azure environment — your data is not sent to a third-party model provider.

How your data is handled

  • Tenant isolation. Every customer's data lives in an isolated tenant. Queries are scoped to the calling tenant at the data layer, so one customer can never reach another's code or data.
  • Read-only database access. Database queries run through a read-only wrapper. The agent can read your production data to answer questions; it cannot modify it.
  • Secrets stay in Key Vault. Your database connection strings are stored in Azure Key Vault and fetched at runtime — never in application settings or source. If you'd rather we never hold a credential at all, the on-prem connector keeps it inside your network.
  • Full audit trail. Every agent action — each search, query, and response — is logged so you can review exactly what was accessed and when.
  • Encryption. Data is encrypted in transit (TLS) and at rest using Azure's platform encryption.

Subprocessors

We keep our supply chain small. Codepanion runs entirely on Microsoft Azure; we do not use a separate analytics, logging, or model vendor outside it.

SubprocessorPurpose
Microsoft AzureCloud hosting, compute, storage, and managed databases. The product runs entirely on Azure.
Azure OpenAI / Azure AI FoundryThe AI models behind the agent (chat completions and embeddings). Operated by Microsoft within Azure; contractually no-train. Deployed on Azure's Global Standard tier, so Microsoft may route individual model requests to Azure data centers in other regions under Microsoft's product terms; data at rest stays in the US.
Azure Communication ServicesTransactional email (invites, welcome messages, notifications).

Reporting a vulnerability

If you believe you've found a security issue, please email security@codepanion.app rather than opening a public issue. We aim to acknowledge reports within two business days and will keep you updated through to a fix.

We operate in good faith with researchers: security testing carried out in line with our disclosure policy — avoiding privacy violations, service disruption, and access to other customers' data — is authorized, and we will not pursue legal action over it. The full policy and safe-harbor terms are published as SECURITY.md and as /.well-known/security.txt.

Security questionnaires

Running a vendor review or need more detail than this page covers? Email security@codepanion.app and we'll work through your questionnaire with you.