Buying AI coding tools: the security, legal and data questionnaire

A procurement questionnaire for AI coding tools asks each vendor about retention, training use, zero data retention (ZDR), processing region, SSO and SCIM, audit logs, IP indemnity and subprocessors. It accepts only answers that name the exact product surface, plan and model route, because one vendor answers differently for each, and then proves them in a trial tenant.

Your security team sends Anthropic, OpenAI and Anysphere the same 300-row SaaS questionnaire it sends every vendor. The answers come back as one sentence: “we do not train on your data.” That is true for the enterprise plan the vendor quoted, not for the consumer accounts your engineers already use, and it says nothing about the transcripts on each laptop.

This page gives the CTO who runs the evaluation, the executive who signs, and their security, legal and data-protection reviewers the 40 questions, what the vendors’ documents already answer, evidence grades, a decision table and trial tests. It is not legal advice: take the legal rows to counsel with the legal and IP checklist.

Why does a standard SaaS questionnaire miss the risks of coding agents?

A generic questionnaire assumes one product, one data store and one set of terms. Coding agents break all three. The account decides the terms: the same Claude Code binary runs under Consumer Terms on Free, Pro and Max and under Commercial Terms on Team, Enterprise and the API. The plan and the model route change the answer: SSO, SCIM and ZDR sit on different plans, and ZDR does not follow you onto a cloud marketplace. And the client creates data of its own, while strict settings such as ZDR switch features off (rows B3, B4 and C3).

So every question below carries one instruction: answer per surface, per plan, per model route. An answer without that scope is graded as unanswered.

The questionnaire: 40 questions in nine sections

Send it in writing. “Accept” is what a complete answer contains; “Verify by” is how you check it yourself.

A. Scope: what exactly is being answered?

#	Ask the vendor	Accept an answer that	Verify by
A1	Which surfaces does each answer cover: CLI, IDE extension, desktop, web or cloud agents, review bots, mobile, chat integrations?	Lists every surface you will license	The order form’s product lines
A2	Which model routes are in scope: your API, a cloud marketplace (Bedrock, Google Cloud, Foundry), or our gateway?	Answers each later section per route	Your planned model hosting architecture
A3	Which terms document, in which version, governs each plan?	Names document, version and effective date	The document, filed in your terms register
A4	Which account types can reach our code, and can an admin block the rest?	Separates consumer from business accounts and names the blocking control	Trial test T1

B. Retention and training use

#	Ask the vendor	Accept an answer that	Verify by
B1	What do you retain (prompts, completions, files, tool output, transcripts), and for how long, per plan and route?	Gives a period per data type and plan	Dated data-usage page or DPA annex
B2	Is any of it used for training? What is the default, and who can opt us in?	Says “no by default under commercial terms” and names every opt-in programme and its controller	Contract clause and the opt-in state in your admin console
B3	What leaves through feedback commands, bug reports, satisfaction surveys, telemetry and error reports, and for how long?	Lists each channel, its retention and its admin switch	Trial test T4
B4	What does the client store on the developer’s machine, where, for how long, encrypted or not?	Names the paths and the retention setting	Inspect a trial machine
B5	How do we delete sessions and data, and when is deletion complete, backups included?	Gives a mechanism and a time bound	Delete a trial session; get written confirmation

C. Zero data retention

#	Ask the vendor	Accept an answer that	Verify by
C1	Is ZDR available on our plan, at what cost, and who enables it?	States eligibility, cost and enablement path	Order form line or written confirmation
C2	Is ZDR per organization or workspace, and do organizations we create later inherit it?	Says exactly what a new organization inherits	Create a second trial organization
C3	Which features are disabled under ZDR, and which were never covered by it?	Gives both lists	Trial test T5
C4	Which models require retention, or are unavailable, under ZDR?	Names the models and the governing policy	The model picker in a ZDR trial organization
C5	What do you retain anyway, for legal or abuse reasons, and how long?	Gives the trigger and maximum period	Contract or policy text

D. Region and residency

#	Ask the vendor	Accept an answer that	Verify by
D1	Where is inference processed and data stored at rest, per model route?	Gives regions per route	DPA annex; cloud-route documentation
D2	Can an admin enforce a region on every client, and what does that cost or disable?	Names the control, price effect and lost features	A managed setting on a trial machine
D3	What transfer mechanism covers data leaving the EEA?	Names it in the DPA	The DPA; see EU software regulation for GDPR processor duties
D4	How is data encrypted at rest, and can we bring our own keys?	Names algorithm and key option per route	Cloud-route documentation

E. Identity: SSO, SCIM and login control

#	Ask the vendor	Accept an answer that	Verify by
E1	Which plan includes SSO (SAML or OIDC), and can it be enforced for every member?	Names the plan and the enforcement switch	Trial test T1
E2	Which plan includes SCIM, and how fast do CLI tokens, IDE sessions and running cloud agents lose access after deprovisioning?	Gives a time bound per surface	Trial test T2
E3	Can we pin logins on managed machines to our organization and block personal accounts?	Names the managed setting	Trial test T1
E4	Which admin roles can change privacy, retention and model settings?	Lists roles and rights	The trial tenant’s admin console

F. Audit logs and admin visibility

#	Ask the vendor	Accept an answer that	Verify by
F1	Which admin and security events do you log, for how long, and how do we export them?	Lists events, retention and export format	Trial test T3
F2	Which per-user usage data can we pull by API: content or only metadata?	Separates content from metadata	Call the API in the trial tenant
F3	Can the client export telemetry to our OpenTelemetry collector, with prompt text off by default?	Names the setting and default	Point a trial client at a test collector
F4	Are cloud-agent actions logged, and can we see the log?	Describes the log and your access	Run one cloud task and read its log

G. Legal terms

#	Ask the vendor	Accept an answer that	Verify by
G1	What does your IP indemnity for outputs cover and exclude?	Quotes the clause, including exclusions for modified or combined outputs	Counsel; see legal and IP
G2	Who owns inputs and outputs?	Quotes the ownership clause	The terms document
G3	How, and with what notice, can you change the terms, and does the order form prevail?	Gives a notice period and precedence rule	The order form
G4	Is there a DPA, which roles does it assign, and what is your breach-notification deadline?	Provides the DPA with controller and processor roles	The signed DPA
G5	Which certifications cover this product, not just the company (SOC 2 Type II, ISO/IEC 27001, ISO/IEC 42001), and do you sign a BAA?	Provides reports whose scope names the product	The report’s scope section

H. Subprocessors and model providers

#	Ask the vendor	Accept an answer that	Verify by
H1	Who are your subprocessors, every model provider included, and where does each process our data?	A dated list with locations	The published list, filed with its date
H2	How do you notify us of a new subprocessor, and can we object?	A notice period and an objection right	The DPA
H3	For each model you offer, which company processes the request, under what retention, and can an admin restrict us to compliant models?	Answers per model and names the control	The trial tenant’s model list
H4	Who is responsible for data the agent sends to MCP servers, connectors and other integrations?	Says integrations follow their own terms, or covers them by contract	Your MCP allowlist and MCP security policy

I. Agent execution and client security

#	Ask the vendor	Accept an answer that	Verify by
I1	Where do cloud agents run, how are they isolated, and what egress do they have?	Describes isolation and egress controls	Vendor security documentation
I2	How are repository and other credentials held for cloud agents?	Says whether credentials enter the execution environment	The same; see agent identity and secrets
I3	Can admins enforce permissions, MCP servers, plugins and hooks so developers cannot override them?	Names the managed configuration mechanism	Deploy it to a trial machine; see managed policy
I4	Can we pin client versions or a release channel, and how do security fixes ship?	Names channels and update control	The client’s settings
I5	How do researchers report vulnerabilities, and how are customers notified?	Names the programme and notification path	The public disclosure page

What do the vendors’ own documents already answer?

Read these before the vendor call, so it covers only the gaps. Each row is what the vendor published on 2026-09-26, not your contract; re-read the source before you rely on it.

Claude Code

Sources: Anthropic’s Claude Code pages on data usage, zero data retention, feature availability, legal and compliance and authentication.

Question	What the documentation said on 2026-09-26
A3 terms	Commercial Terms for Team, Enterprise and API users; Consumer Terms for Free, Pro and Max
B1 retention	Commercial: 30 days standard. Consumer: 5 years if the user allows model improvement, 30 days if not
B2 training	“Anthropic does not train generative models using code or prompts sent to Claude Code under commercial terms”, unless the customer opts in, for example through the Development Partner Program, which an organization admin enables and which exists only on the first-party API
B3 feedback	Transcripts sent with /feedback, /bug or /share are kept for 5 years; DISABLE_FEEDBACK_COMMAND=1 turns the command off. The optional transcript share after the session-quality survey uploads the transcript and session log, kept up to 6 months; CLAUDE_CODE_DISABLE_FEEDBACK_SURVEY=1 disables the survey
B4 local data	Transcripts in plaintext under ~/.claude/projects/ for 30 days by default, adjustable with cleanupPeriodDays
C1, C2 ZDR	Qualified Claude for Enterprise accounts only; not in the standard Enterprise plan; enabled per organization by the account team; a new organization does not inherit it
C3 ZDR scope	Not covered: claude.ai chat, Cowork, analytics metadata, seat management data, third-party integrations. Disabled: cloud sessions, Claude Tag, Artifacts, feedback commands, Remote Control. Code Review and Ultrareview are not available to ZDR organizations, and the analytics dashboard shows usage metrics only, without contribution metrics
C4 models	Fable 5.1 and Fable 5 are Covered Models that require retention by default; whether a ZDR organization can use them is governed by the Covered Models policies
C5 retention anyway	Flagged sessions: inputs and outputs may be kept for up to 2 years, even under ZDR
D1, D4 route	ZDR applies only to Anthropic’s direct platform. Encryption at rest: AES-256 on the Anthropic API; AWS-managed keys with customer-managed keys through AWS KMS on Bedrock; CMEK on Google Cloud; on Microsoft Foundry “Hosted on Azure”, prompts and completions stay within Azure
E1, E3 identity	SSO on Team and Enterprise. forceLoginMethod and forceLoginOrgUUID in managed settings pin claude.ai logins to your organization; deploy them through device management, because server-managed settings cannot redirect a first login. Not checked against the organization: Claude Console logins (the UUID only pre-selects it), sessions signed in before the keys arrived, and claude setup-token and /install-github-app, which enforce only forceLoginMethod
E2 SCIM	Enterprise only
F1, F2 audit	Compliance API and Enterprise Analytics API on Enterprise; analytics dashboard on Team and Enterprise; audit logs are among the ZDR admin capabilities; a self-hosted Claude apps gateway keeps its own audit log and sends neither it nor your developers’ IdP identity to Anthropic
G5 BAA	A signed BAA extends to Claude Code API traffic only when ZDR is enabled for that organization. Compliance reports are in the Anthropic Trust Center

The gateway trap for D2 and I3: when ANTHROPIC_BASE_URL points at any host other than api.anthropic.com, Claude Code turns off server-managed settings and Remote Control. Your data route and your policy route are one decision.

Codex

Sources: the managed-configuration source in openai/codex (config_requirements.rs, model-provider-info, types.rs) and the local codex-cli 0.157.1, both checked on 2026-09-26. OpenAI’s policy pages were unreachable from the environment this page was written in, so this tab states only what the client enforces; send every B, C, E, F, G and H question to OpenAI in writing.

Question	What the client supports
A4, E3 accounts	Managed requirements.toml keys allowed_login_methods and allowed_chatgpt_workspaces restrict sign-in method and workspace. codex login status shows the current login
D2 region	enforce_residency in requirements.toml; the only value the source accepts is "us". OpenAI’s GPT-6 Astra upgrade guide notes that Fast mode is unavailable with EU data residency, so ask how EU residency works for your workspace
B4 local data	[history] persistence = "none" in config.toml stops writes to ~/.codex/history.jsonl
B3 feedback and analytics	[feedback] enabled = false and [analytics] enabled = false in config.toml. An admin can also set [feedback] enabled = false in the managed requirements.toml, so the user cannot turn feedback back on
F3 telemetry	An [otel] table exports logs, traces and metrics; log_user_prompt defaults to false
I3 central control	requirements.toml also constrains mcp_servers, plugins, marketplaces, allowed_permission_profiles, allowed_sandbox_modes, allowed_approval_policies and allow_managed_hooks_only

The Codex README says Codex is included in the Plus, Pro, Business, Edu and Enterprise plans. Plus and Pro are individual plans, so answer A4 before anything else.

Cursor

cursor.com was unreachable from the environment this page was written in on 2026-09-26, so this tab makes no claim about Cursor’s plans or retention. Put the whole questionnaire to Anysphere, and weight three rows:

• H3. For each model you allow, the processing company and its retention terms in writing, and the admin control that restricts members to those models.
• B2 and E3. Which setting keeps code out of training and retention, whether an admin can enforce it, and what happens to a member who joins with it off.
• B1 and I1. Cursor’s documentation, checked 2026-08-28, describes Cloud Agents that “run in isolated VMs in the cloud with full development environments”. Ask how long code and session data in those VMs is kept.

Then check each answer in a trial team’s admin console, with the date.

How do you verify each answer against the exact product and plan?

A written answer is a claim. Grade it by its strongest evidence, then close the gap between claim and machine with a trial tenant and managed configuration.

Grade	Evidence	Where it is enough
A	Contract text or DPA for your plan, and reproduced in your trial tenant or enforced by managed configuration	Required for sections B, C, E and H
B	Vendor documentation that names your plan and route, dated when read	Acceptable for D, F and I, with a re-check date
C	A sales email, call notes or a trust-center summary	Never enough on its own; turn it into A or B before signature
D	No answer, or an answer without plan and route	Treat as “no”

1. Write the scope line first. One sentence per tool: surfaces, plan, model route, seats and allowed data classes, for example “Claude Code CLI and VS Code extension, Enterprise plan, Anthropic API route, 120 seats, internal and confidential code, no personal data.” The data classification decides the data classes.

2. Ask for documents, not answers: order form draft, terms version, DPA, dated subprocessor list and the SOC 2 Type II report with its scope section, each filed with its date.

3. Map every answer to a clause with the first prompt below: a quoted clause, a dated documentation page, or NOT FOUND.

4. Reproduce the critical answers in a trial tenant with the tests below, on two managed machines. Run the pilot in the same tenant.

5. Enforce what you verified with managed policy. An answer no setting enforces is a promise, not a control.

6. Decide with the grades, then sign, and file the grades with the contract for the renewal.

Which trial-tenant tests prove the critical answers?

Run these on a managed machine with the configuration you plan to deploy; each pass condition can be screenshotted and dated.

Test	Proves	Steps	Pass condition
T1	A4, E1, E3: only company accounts work	Sign in with a personal account	The client refuses the login or exits at startup
T2	E2: deprovisioning cuts access	Remove a test user in your IdP, then use the CLI, the IDE and a running cloud agent	Every surface loses access within the stated time
T3	F1: admin actions are logged	Change a privacy or model setting, then export the audit log	The event shows actor, time, old and new values
T4	B3: nothing leaves through feedback	Run the feedback command and watch outbound traffic	The command is disabled or blocked by the documented switch
T5	C3: the ZDR carve-outs are as stated	Try each feature on the “disabled under ZDR” list	Each returns the documented error; none is on your must-have list
T6	B4: local data follows policy	Inspect the local data directories after a day of use	Retention and contents match the deployed setting

The commands that show which account and organization a machine uses:

Claude Code

# terminal on the managed trial machine (Claude Code 2.1.283)
claude auth status --text

With forceLoginMethod and forceLoginOrgUUID deployed, a claude.ai login to another organization produces an error and Claude Code exits at startup: the T1 pass. Repeat T1 for the unchecked paths in the E1, E3 row above: a Console login, a session signed in before the keys arrived, claude setup-token and /install-github-app (authentication page, checked 2026-09-26, Claude Code 2.1.283). These paths are expected to succeed; record the result and name the compensating control (device-management sign-out, API-key policy) in the decision table.

Codex

# terminal on the managed trial machine (codex-cli 0.157.1)
codex login status

With allowed_login_methods and allowed_chatgpt_workspaces in the managed requirements.toml, a login outside those values is the T1 case. Record the exact message the client prints as evidence.

Cursor

Cursor’s login controls could not be verified on 2026-09-26. Run T1 against a trial team with the vendor’s recommended settings, and record a dated screenshot.

How do the grades turn into a buying decision?

Situation	Decision
Every row in B, C, E and H is grade A, the rest are B or better	Buy
A row in D, F or I is grade C, with a compensating control (for example a gateway that logs requests)	Buy with a written condition and a date to close it
Any B, C, E or H row is below A for a data class in the scope line	Narrow the scope line, or stop
A must-have feature is disabled under the retention setting you need (T5)	Choose the feature or the setting, in writing, before signature
The vendor will not answer per plan and route	Stop; the answers cannot be verified

Sign-off follows the sections. Security owns E, F and I; legal and the data-protection officer own B, C, D, G and H; the CTO owns the scope line, the trial tests and the managed configuration. The executive signs only when the table says buy or the conditions are in the order form, and first asks who accepted the features the retention setting removes and when T1 last ran.

Copy-paste prompts for the vendor review

Run these in any of the three agents with the vendor documents in the working directory. They prepare evidence for reviewers; they do not replace them.

Copy-paste prompt: map vendor documents onto the questionnaire

The files in ./vendor-docs/ are one AI coding tool vendor's order form, terms, DPA,
subprocessor list and security documentation. The file ./questionnaire.md holds our
40-question questionnaire in sections A to I, and ./scope.md holds our scope line
(surfaces, plan, model route, data classes).
For every question, output one table row: question id, the answer, the exact quote
with document name and section number, whether the quote names our plan and our
model route (yes / no / unclear), and an evidence grade: A only if it is contract text
for our plan, B if it is dated documentation naming our plan, C otherwise, D if NOT FOUND.
Quote, never paraphrase. Do not infer an answer for one plan from text about another.
End with the list of D and C rows, grouped by section. Write to ./vendor-review.md.

Copy-paste prompt: find where our real usage falls outside the answers

Read ./vendor-review.md (the graded vendor answers) and ./scope.md.
Then inspect how we actually use this tool, without changing anything:
1. List every managed settings, requirements.toml or policy file here and in
   ./it-config/, and what each enforces (login, models, retention, telemetry,
   feedback, MCP servers, plugins), plus every configured MCP server and plugin.
2. For each item, name the questionnaire row and whether the vendor's answer
   applies (same plan, same route).
Output a table of mismatches with the risk in one sentence and the owner
(security, legal/DPO or CTO). Never mark anything as compliant.

Copy-paste prompt: write the trial-tenant test plan

Using ./vendor-review.md, write a trial-tenant test plan for this vendor.
For each row graded B or C in sections B, C, E, F and H, design one test on a
managed machine that would turn it into grade A: steps, evidence to capture and
pass condition. Output a checklist we can run in one day, owner column blank.

How do you keep the answers true after signature?

Answers decay as vendors add surfaces, models, subprocessors and terms. Re-check from the same register the legal team uses:

Trigger	Re-check	Owner
Quarterly	Terms version, subprocessor list, one run of T1 and T3	CTO, with security
A new plan, surface or model route	The whole questionnaire for the new scope line	CTO
A new model, especially one with its own retention rules	C4 and H3	Security
A subprocessor or terms-change notice	H1, H2 and the changed clauses	Legal / DPO
A new MCP server or integration	H4 and the MCP security policy	Platform team
Renewal	Every grade, 90 days before the renewal date	CTO and procurement

If you are building toward ISO/IEC 42001 or SOC 2, the dated grades and test results are the vendor-management evidence those audits ask for; see AI management standards.

What goes wrong when you buy AI coding tools?

The answers describe a plan you did not buy. The vendor answered for Enterprise; your order form says Team. Recovery: re-grade every row against the order form, then upgrade the plan or narrow the scope line.

Personal accounts keep working after the rollout through the paths in row E1, E3. Recovery: force a sign-out through device management, run T1 on every machine, and let legal assess past sessions as a disclosure.

ZDR switched off the feature the pilot depended on (row C3). Recovery: pilot under the retention setting you will buy, with T5 in the entry criteria.

The gateway broke central policy (the gateway trap above). Recovery: deliver managed settings by file or MDM, or use Anthropic’s self-hosted Claude apps gateway, which serves them by IdP group; then re-run the trial tests on that route.

An integration carried the data out. An MCP server sent the code to a service nobody reviewed. Recovery: an MCP allowlist in managed configuration, and an H4 review for every server on it.

The certification did not cover the product. The SOC 2 report’s scope named the company’s API, not the coding tool. Recovery: ask for a report or bridge letter that names the product, and grade G5 as C until then.

Nobody noticed a terms change. Recovery: the quarterly re-check above, and the date read next to every quoted clause.

Where to go next after procurement

Where the model runs decides the model route in your scope line. After buying, enforce the answers with managed policy and prove the value with a pilot.

Legal and IP questions Ownership, license contamination, indemnities and client clauses, as a checklist for counsel.

Where the model runs Gateways, cloud routes, residency and zero retention: the route every answer depends on.

Enforcing one policy across every agent Managed settings that make the verified answers true on every machine.

Vendor risk management Test continuity and switching, not logos.

Avoiding lock-in Portable context, skills and pipelines, so a failed renewal is not a crisis.