CodeRabbit Data Handling

Overview

Map what CodeRabbit may read, retain, cache, and export before changing controls. Exclusions do not replace source-control secret prevention.

Prerequisites

• Identify the CodeRabbit organization, Git provider, repository, plan, and accountable owner.
• Read references/official-docs.md and re-check any time-sensitive contract before execution.
• Use synthetic or read-only evidence until the approval boundary is satisfied.
• Preserve the repository's independent CI, security, and human-review requirements.

Current Contract

• Cached data is documented as never used for training and expiring within one week.
• Cached data is encrypted except for open-source projects.
• Organizations can disable cache or data retention.
• Path filters change review surfaces, not Git history or provider access.