Sourcegraph AI Vendor Risk Profile
Code intelligence platform offering Cody, an AI coding assistant with deep codebase context. Provides code search, navigation, and AI-powered code explanation, generation, and refactoring across large codebases.
Risk overview
Risk score: 34/100
Risk tier: Moderate
Safety rating: 66/100 (higher is better)
Lower risk scores indicate lower assessed risk.
Last verified: Apr 19, 2026 Aging
Risk dimensions
| Dimension | Risk score |
|---|---|
| Data Handling | 28/100 |
| IP Exposure | 31/100 |
| Jurisdiction | 13/100 |
| Security | 40/100 |
| Regulatory Compliance | 60/100 |
| Transparency | 70/100 |
| Business Stability | 26/100 |
| Dependency Chain | 30/100 |
| Agent Governance | Not assessed |
Analyst summary
Rating: Acceptable
Sourcegraph's Cody AI coding assistant is the strongest enterprise-oriented competitor to GitHub Copilot, with self-hosted, single-tenant cloud, and customer-managed Kubernetes deployment options that deliver true data residency control. Bring-your-own-key support for Anthropic, OpenAI, and other LLMs gives customers negotiating leverage on upstream model costs and contracts.
Bottom line: The default choice for enterprises that need self-hosted or customer-controlled AI coding assistance.
Strengths
- Full deployment flexibility: self-hosted, single-tenant cloud, or customer-managed Kubernetes
- Bring-your-own-key for major LLM providers with zero-retention contracts
- No training on customer code; Cody Enterprise enforces zero-retention end to end
- SOC 2 Type II certified with GDPR DPA
- Strong code-search and cross-repo context retrieval features
Concerns
- Smaller company than GitHub/Microsoft with more limited enterprise features
- Competing against GitHub Copilot's ecosystem momentum and Microsoft inheritance
- No IP indemnification on Cody-generated suggestions
- No published HIPAA BAA or FedRAMP authorization
Best for
- Enterprises requiring self-hosted or customer-managed coding AI deployment
- Organizations with large, complex monorepos benefiting from Cody's code search
- Teams wanting BYO-LLM flexibility to negotiate their own upstream contracts
- Non-GitHub-standardized shops wanting mature enterprise coding AI
Avoid if
- You are already heavily invested in GitHub Enterprise Cloud and Copilot
- You need IP indemnification on AI-generated code
- You require FedRAMP or HIPAA BAA coverage for developer tooling
Citations
- Data Handling — Data Residency Options
Sourcegraph supports self-hosted, single-tenant cloud, and customer-managed Kubernetes deployments, providing full data residency control.
- Data Handling — Third Party Data Sharing
Cody Enterprise supports bring-your-own-key for Anthropic, OpenAI, and other LLM providers with zero-retention contracts.
- Data Handling — Trains On User Data
Sourcegraph does not use customer code or Cody prompts to train AI models. Cody Enterprise enforces zero-retention with upstream LLM providers.
- Ip Profiles — User Owns Outputs
Customer owns all Customer Content, including code suggestions generated by Cody based on Customer's codebase.
- Jurisdiction Profiles — Incorporation Country
Sourcegraph, Inc. is a Delaware corporation headquartered in San Francisco, California.
- Security Compliance — Gdpr Compliant
Sourcegraph provides a GDPR-compliant Data Processing Addendum for enterprise customers.
- Security Compliance — Soc2 Type2
Sourcegraph maintains SOC 2 Type II compliance covering its cloud and enterprise offerings.