TL;DR
Sourcegraph Cody combines code search with AI assistance, designed for enterprise use. It offers self-hosted deployment, SOC 2 compliance, and won't use your code to train models. Cody can query your entire codebase for context, which is its main strength and the reason access control matters more here than with most other AI coding tools.
How Cody Works
Cody is Sourcegraph's AI coding assistant, built on top of their code search engine:
- Code intelligence: Uses Sourcegraph's code graph for deep context understanding
- Codebase-aware: Can search and understand your entire repository
- Multiple LLMs: Supports different AI providers
- IDE integration: Works in VS Code and JetBrains IDEs
Enterprise Security Features
Cody targets enterprise deployments from the start. A few features matter here:
Deployment Options
- Self-hosted: Run entirely within your infrastructure
- Cloud: Managed service with strong data protection
- Hybrid: Code stays on-premise, AI processing in cloud
Compliance
- SOC 2 Type 2 certified
- GDPR compliant
- No training on customer code
- Audit logging available
Access Control
- SSO integration (SAML, OIDC)
- Repository-level permissions
- Admin controls for AI features
- User activity monitoring
Security Considerations
The enterprise features are real. There are still a few things to watch:
Codebase Context
Cody's strength is understanding your entire codebase. That's also the source of its biggest risk: it can pull context from any code indexed by Sourcegraph, including multiple repositories. Get permissions right before you enable it.
- Any code indexed by Sourcegraph is accessible to Cody
- Responses may include context from repositories a user didn't explicitly reference
- Repository permissions must be configured before rollout
Access control: Cody respects Sourcegraph permissions. Ensure users can only access repositories they're authorized to see before enabling Cody.
Generated Code Quality
Cody-generated code has the same gaps you'd see from any AI tool. Review for:
- Check for security vulnerabilities
- Verify authentication and authorization logic
- Review for hardcoded secrets
- Validate input handling
Configuration Best Practices
For Administrators
- Review and configure repository access permissions
- Enable audit logging
- Set up SSO integration
- Configure which AI models are available
- Consider which repositories should be indexed
For Developers
- Understand what context Cody can access
- Don't share secrets in prompts
- Review generated code for security issues
- Report any unexpected behavior
Self-Hosted Deployment
Self-hosted Sourcegraph is the highest-security option. It's worth considering if your team has strict data requirements:
- Code never leaves your infrastructure
- Full control over data retention
- Can use your own LLM providers
- Airgapped deployment possible
Enterprise tip: Self-hosted deployment with on-premise LLMs provides the highest level of code privacy. Evaluate your security requirements when choosing deployment options.
Is Sourcegraph Cody secure for enterprise use?
Cody is designed for enterprise use with self-hosted deployment options, SOC 2 compliance, and code not being used to train models. It integrates with your existing code search infrastructure for secure AI assistance.
Does Cody access my entire codebase?
Cody uses Sourcegraph's code intelligence to understand your codebase context. For self-hosted deployments, code never leaves your infrastructure. For cloud, Sourcegraph has strict data handling policies.
Can I run Cody on-premise?
Yes. Sourcegraph offers self-hosted deployment options where Cody runs entirely within your infrastructure. This is ideal for enterprises with strict data residency requirements.
Does Cody train on my code?
No. Sourcegraph does not use customer code to train AI models. Your code is used only to provide context for your own requests.
Using Cody?
Scan your project for security issues in AI-assisted code.