← All guides · Code & privacy
Is it safe to paste your code into an AI chatbot?
Usually fine. Sometimes genuinely risky. The difference isn't the code itself, it's what's hiding inside it and what the tool on the other end does with what you send.
What actually happens when you paste code
It depends entirely on the tool, and most people never check. Three things matter: whether the provider trains future models on what you send, how long they retain it, and whether a human could ever end up reading it (support tickets, abuse review, etc). Every major AI product has a policy on this, usually in a settings page you've never opened. Read it once for whatever tool you use daily, it takes two minutes and it's the whole ballgame.
The real risk usually isn't the code, it's what's next to it
- Hardcoded secrets. API keys, database passwords, and tokens pasted along with a stack trace, because they were sitting right there in the config file you copied.
- Proprietary or NDA'd code. Employer or client code you're not actually allowed to share outside your org, regardless of how the AI tool handles it.
- Internal infrastructure details. Internal hostnames, IP ranges, or architecture notes in comments that reveal more about your systems than the bug itself needs.
- Customer data in test fixtures. Real user records copy-pasted into a "here's my test data" prompt because it was faster than writing fake data.
Before you paste, do this
- Search the snippet for anything that looks like a key, token, password, or connection string before you hit send, not after. The OWASP Secrets Management Cheat Sheet explains why exposed secrets need controlled storage and rotation.
- Replace real values with obvious placeholders (
YOUR_API_KEY) rather than trusting yourself to remember to redact later. - Check whether your employer has an actual policy on this. Plenty do, and "I didn't know" doesn't help once code is out.
- Check the provider's current policy instead of assuming what it does with prompts. Also use repository protections such as GitHub secret scanning where available.
How Sevoria handles this
Sevoria is a hosted service, not an entirely on-device model. Core and Reason normally run on Sevoria-operated compute. Code and limited premium routes may send your prompt and the necessary conversation context to OpenRouter for inference, as described in the Subprocessor List. Sevoria does not use conversations to train its own models, but an external provider's current terms apply when its route is selected. Redact secrets and restricted code whichever route you use.
Code privacy FAQ
Is it different for personal projects vs. work code?
The privacy mechanics are the same either way. What changes is the consequence: leaking your own side project is your call, leaking employer code can be a real problem regardless of how careful the AI tool is.
Are local AI models actually safer for this?
A genuinely on-device tool can reduce third-party exposure, but "local" is not automatically synonymous with "private." Check the complete data flow, including sync, telemetry, search, and fallback providers. Sevoria itself is hosted, so treat anything you send as information leaving your device.
What if I already pasted a real secret by accident?
Rotate it immediately, treat it as compromised the moment it left your machine, regardless of which AI tool received it or what their policy says.
Try Sevoria for code More on privacy
Was this useful?
Thanks, noted.