Data handling

ADO Pilot sends only the data that an AI reviewer needs to comment on a pull request: the diff content of changed files and their paths. Your full source tree is never read, copied, or indexed. The diff is processed by our systems for the duration of the review — see How long content lives below for what happens to it afterward.

What we send to Anthropic

For each review, ADO Pilot makes up to two review passes, each a separate request to Anthropic's Claude API — occasionally with an additional fallback request if a pass needs to retry. Each request contains up to three pieces of content, sent as part of the request:

• The unified diff of files changed in the pull request — added, removed, and context lines as Azure DevOps returns them, including the file paths embedded in the diff headers so Claude can reason about language and structure.
• Code-structure context derived from the changed files — type signatures, function declarations, and surrounding structural context — when our enrichment pipeline can extract it, so the reviewer can reason about code beyond the diff hunks.
• Static-analysis findings produced from the same diff, when any are detected, so the reviewer can correlate them with the code under review.

Your exclusion patterns and other review configuration are applied on our side to decide which file changes reach the diff in the first place; the rules themselves are never sent to Anthropic. Pull request metadata such as the PR title, description, and source and target branch names is used internally to route the review and create review records on our side — it is not included in the prompt.

The system instructions we send Claude are not customer-specific. They describe how to review code; they do not contain any tenant data.

What we don't send

• Files outside the diff. ADO Pilot does not clone your repository or walk your source tree.
• Files matched by your exclusion patterns. Binary files (images, fonts, media, archives) and common lockfile and source-map file extensions are excluded automatically; minified bundles, package-lock.json/pnpm-lock.yaml, and other generated code are only excluded if you add them to your own exclusion patterns.
• Build artifacts, test fixtures, or pipeline outputs.
• Customer credentials. Personal access tokens are encrypted at rest before they reach our database. Service-principal (Microsoft Entra) auth stores no long-lived credential at all — the backend mints short-lived tokens on demand. Either way, your credentials are used only to call the Azure DevOps REST API on your behalf and are never sent to Anthropic.
• Identity data beyond what already appears in PR metadata. We do not enrich the prompt with user directory data or commit history outside the PR.

How long content lives

Content sent to Anthropic as part of a review may be cached ephemerally to keep review passes fast and costs predictable. This happens entirely within Anthropic's infrastructure, is scoped to ADO Pilot's own API account, and is never shared across customers.

Findings, the verdict, and usage metadata are stored on our side as the durable record of the review. The diff content itself is written to temporary, encrypted, access-controlled storage in our processing infrastructure for the duration of the review — not held only in memory — and is deleted immediately once the review completes. As a safeguard for the rare case a review doesn't finish cleanly, an automated process guarantees deletion of any remaining copy within seven days at most.

Anthropic's commitments

Anthropic processes the prompt to generate a response. Anthropic does not use customer prompts or completions to train its models. Anthropic's retention period for prompts and completions is governed by their Commercial Terms and the Data Processing Addendum (DPA) we sign with them; the contractual language is referenced from our legal page. We'll work with qualifying Enterprise customers to arrange a Zero Data Retention (ZDR) configuration under which neither we nor our subprocessors (including our AI provider) will retain your data at rest — contact sales@adopilot.dev to discuss your requirements.

For Anthropic's own privacy commitments, see Anthropic's Privacy Policy and Trust Center.

Legal basis

We process your code on your behalf to deliver the review service you asked for — the legal basis is contract performance. ADO Pilot acts as a data processor; you remain the controller. The full processing terms, subprocessor list, and Standard Contractual Clauses for transfers out of the EEA, UK, and Switzerland are in the DPA, available from the legal page.

If you have a question about how a specific data class flows through ADO Pilot that this page doesn't answer, the tenant isolation page covers the storage and access boundaries on our side.