Settle Greptile's data sharing and training settings, and choose between Greptile Cloud and self-hosting, before you connect a repository. On Greptile Cloud, code stays cached on Greptile's servers until you revoke access. Help us improve Greptile is on by default, and the security page allows training on de-identified customer data until you opt out.
When you need this
- Security review has to approve a vendor that reads your private repositories.
- Data residency or air-gapped requirements rule out a multi-tenant cloud service.
- Access has to follow your identity provider, including removal when people leave.
Evaluation criteria
Code storage
Where does our code live after a review?
Look forGreptile Cloud caches code on an encrypted AWS filesystem until you revoke GitHub or GitLab access, then deletes it. It also stores embeddings of file paths and documentation, plus AI-generated docstrings. Greptile destroys backups within 30 days.
Training and data sharing
Does Greptile train on our code or review activity?
Look forOpt out in account settings if you do not permit training on de-identified customer data. Help us improve Greptile is a separate setting under Settings, Organization. It defaults to on and learns from comments and replies, including reactions. An admin can disable it.
Deployment model
Greptile Cloud or self-hosted?
Look forGreptile Cloud is SOC 2 Type II. Enterprise self-hosting uses Docker Compose for up to 100 developers and Kubernetes above that, including air-gapped deployments. Supply your own LLM through an OpenAI-compatible API or AWS Bedrock. Self-managed code hosts also require Enterprise.
Identity and access
How do people get access, and how do they lose it?
Look forEnterprise supports SAML 2.0 SSO after domain verification with Okta, Microsoft Entra ID, Google Workspace, OneLogin, or JumpCloud. SCIM 2.0 directory sync, in beta, removes Greptile access when a user leaves the identity provider.
Approval authority
Can Greptile approve a pull request on its own?
Look forBeta auto-approve requires a clean 5/5 review at or below your risk threshold. It supports GitHub, GitLab, Bitbucket Cloud, and Gitea. Exclude sensitive branches, release labels, critical paths, and specified authors through filters. Decide whether branch protection counts the approval.
Questions to ask vendors
- Where is our AI training opt-out recorded, and can the DPA confirm it?
- What happens to embeddings and review history after we revoke repository access?
- Which model providers process our code on Greptile Cloud, and which can we use when self-hosting?
- Can we read the SOC 2 Type II report before the pilot starts?
- Who can enable auto-approve, and where is that change recorded?
Red flags
- Repositories connected before anyone checked the data sharing and training settings.
- Auto-approve enabled without filters for sensitive branches or critical paths.
- Departed engineers keeping access because SSO and directory sync were never set up.
- A security review written for self-hosting when the contract is for Greptile Cloud.
Products in this piece
Sources
- Official documentation
- 8