If your team's answer to "which AI coding assistant do we use?" is still "Sourcegraph Cody," check which plan you are on. Cody Free and Cody Pro were discontinued on July 23, 2025. Cody is an Enterprise-only feature now, and Sourcegraph's pricing page puts Enterprise at a $16K minimum annual contract.
That's the first thing most teams get wrong about Cody in 2026. The second is bigger: running Sourcegraph self-hosted does not keep your code inside your network.
TL;DR
Cody is Sourcegraph Enterprise-only since July 2025. It sends code snippets of up to 28 KB per request to a third-party LLM (Anthropic by default), and that happens even on self-hosted instances, which need outbound internet access to work. Sourcegraph does not train on Enterprise customer code. Permissions are enforced at retrieval time, so Cody's real risk is inherited from however broadly your Sourcegraph instance is already indexed.
What changed, and why your notes are stale
Two vendor changes landed since most teams last wrote down their Cody policy.
Cody Free and Cody Pro ended. Sourcegraph announced the change on June 25, 2025 and cut access on July 23, 2025. The Enterprise Starter plan stopped including Cody on the same date. Cody Enterprise was explicitly unaffected. The Cody docs now open with a single line of eligibility: supported on Sourcegraph Enterprise.
Amp is a different company. When the free plans ended, Sourcegraph pointed individual developers at Amp, its agentic coding tool. Then on December 2, 2025, Sourcegraph and Amp became two separate companies. Quinn Slack and Beyang Liu founded Amp Inc.; Dan Adler became CEO of Sourcegraph.
Check what your DPA actually covers. If developers migrated from Cody to Amp during 2025, your signed agreement, security questionnaire, and vendor review are pointed at Sourcegraph. Amp is now a separate legal entity. That's a new vendor review, not a renewal.
What Cody sends
Here is the part worth reading twice, because it contradicts what a lot of internal wikis say about self-hosting.
Sourcegraph's Cody FAQ describes the flow in four stages:
- You ask a question.
- Sourcegraph searches your indexed code and retrieves relevant snippets, enforcing read permissions so only code you're allowed to see comes back.
- Sourcegraph sends a prompt plus those snippets to a language model.
- The model's response comes back to you.
Step 3 is the one that matters. The snippets leave your network.
Self-hosted does not mean airgapped. Sourcegraph's docs state plainly that Cody sends code snippets of up to 28 KB per request to a third-party cloud service, that the service is Anthropic by default and can be OpenAI, and that a self-hosted Sourcegraph instance must have internet access for those interactions. If your compliance story is "we self-host, so proprietary code never leaves," that story is wrong.
Sourcegraph also acts as the proxy for the LLM provider, so it sits in the path of every request. You can't point Cody at a model without Sourcegraph brokering the call.
The 28 KB cap is a useful number to hold onto. It bounds how much of any single file goes out per request, but it says nothing about volume over time. A developer working through a service for an afternoon can ship a lot of 28 KB slices.
What Cody keeps
Less than teams usually fear, on the training question at least.
Sourcegraph states that for Enterprise customers it will not train on your company's data, and that its third-party LLM providers do not train on your specific codebase. Snippets go out for inference on each request rather than being retained to improve a model.
One structural change backs this up. Cody used to build embeddings of your code, which meant shipping code to a third-party embedding API. Sourcegraph removed embeddings in v5.3 and moved to its own search as the primary context provider, and the first benefit it lists for that change is "no code being sent to a third-party embedding API." Retrieval now runs through the code search index you already control.
Where the models run. Cody's chat models include Claude Opus 5, Claude Sonnet 5, Claude Haiku 4.5, Google Gemini, and OpenAI GPT-5.6 variants. Several autocomplete and Smart Apply models run on Fireworks.ai in a US Iowa region per Sourcegraph's supported models page. If you have data residency requirements outside the US, that is a question for your Sourcegraph contact before rollout, not after.
The risk that's actually yours
Cody respects Sourcegraph permissions. That's genuinely good, and it means the scary-sounding failure (Cody leaking a repo a developer can't open) isn't the likely one.
The likely one is duller. Cody is only as scoped as your Sourcegraph instance, and most Sourcegraph instances were indexed years before anyone attached an LLM to them. Every repo you indexed for search convenience in 2023 is now context an AI assistant can pull from and paraphrase into an answer.
We see the same shape constantly in scans of AI-assisted projects: the tool behaved exactly as configured, and the configuration was written for a world without the tool.
So the audit question isn't "can Cody see too much?" It's "did we ever decide what Sourcegraph should index, or did it just accumulate?"
Reviewing what Cody writes
Everything above is about the data going out. Code coming back is a separate problem, and it's the same one every AI assistant has: generated code carries generated bugs.
The patterns worth checking by hand are authentication and authorization logic, hardcoded credentials, and input handling on anything that touches a database or a file upload. An assistant with deep codebase context writes code that looks consistent with your codebase, which makes a subtle authorization mistake harder to spot in review, not easier.
Can I still use Cody for free?
No. Sourcegraph discontinued Cody Free and Cody Pro on July 23, 2025, and removed Cody from the Enterprise Starter plan. Cody is a Sourcegraph Enterprise feature only, and Sourcegraph's pricing page lists Enterprise starting at a $16K minimum annual contract.
Does self-hosted Cody keep my code inside my own infrastructure?
Not by default. Sourcegraph's docs state that Cody sends code snippets of up to 28 KB per request to a third-party cloud service (Anthropic by default, optionally OpenAI), and that a self-hosted instance needs internet access for those calls. Self-hosting the Sourcegraph instance does not mean your code stays inside your network.
Does Cody train on my code?
No. Sourcegraph states that for Enterprise customers it will not train on your company's data, and that its third-party LLM providers do not train on your specific codebase. Snippets are sent for inference on each request, not retained for training.
Is Amp the same thing as Cody?
No, and they are no longer even the same company. Sourcegraph pointed Cody Free and Pro users to Amp when those plans ended, then on December 2, 2025 Sourcegraph and Amp split into two independent companies. If your team migrated from Cody to Amp, your vendor review now covers the wrong vendor.
Can Cody read repositories a developer is not allowed to see?
No, provided your Sourcegraph permissions are correct. Cody retrieves context through Sourcegraph's search layer, which enforces read permissions per user. The risk is not Cody bypassing permissions, it is Sourcegraph having over-broad permissions configured in the first place.
Using an AI coding assistant?
Scan your project for the security issues AI-assisted code tends to leave behind.