What Copilot Does With Your Code

Understanding what Copilot does with your code is a primary concern for developers working in regulated industries or on proprietary intellectual property. As AI becomes a standard part of the software development lifecycle, the flow of data between your local environment and the cloud requires careful scrutiny. This post examines how popular AI extensions handle your source code and explores alternative architectures like the one found in Deska.

How Large Language Models Process Your Source Code

When you use an AI coding assistant, your code is not just sitting passively in your editor. For the model to provide relevant suggestions, it needs context. This context is typically gathered from your open files, recently visited tabs, and sometimes your entire project structure.

The process generally follows three stages. First, the extension identifies relevant snippets of code around your cursor. Second, this data is sent to a remote server where the model resides. Third, the model generates a response and sends it back to your IDE. The critical question for many teams is what happens to that data once it reaches the server.

Telemetry versus Training Data

It is important to distinguish between two types of data collection. Telemetry includes metadata about how you use the tool, such as which suggestions you accept or how long it takes for a completion to appear. This is generally used for performance monitoring. Training data is the actual content of your files.

Many commercial tools offer different tiers. In some individual plans, your code might be used to fine tune future versions of the model. Enterprise versions often provide a guarantee that your code will not be used for training, although the code still leaves your machine to be processed.

Comparing Cloud-Centric and Local-First Architectures

The industry is currently divided between two major philosophies regarding developer data. The dominant model is cloud-centric, where the heavy lifting of AI inference happens on massive server farms. This allows for very large models but necessitates sending your code over the internet.

The emerging alternative is the local-first approach. In this model, the application prioritizes keeping files and logic on the user hardware. While the AI inference might still happen via an API, the workspace itself and the file orchestration remain strictly local.

Data Privacy in Deska

Deska is a free desktop application available for Mac, Windows, and Linux. It takes a distinct path by offering a local-first workspace. Your code, files, and terminal sessions stay on your machine rather than being synced to a central cloud provider.

When you use the AI features in Deska, you have granular control over how you interact with models. The platform supports multiple coding agents like Claude Code, Codex CLI, and OpenCode. These can be run as panels within an infinite canvas, allowing you to see the inputs and outputs of different models side by side.

• BYOK (Bring Your Own Key): Users on the lifetime tier provide their own API keys. This means you have a direct relationship with the model provider, and Deska does not act as a middleman for your data.
• Managed Inference: Subscribers can use managed services if they prefer not to manage their own keys, but the workspace environment remains local.
• Encrypted Relay: When using the mobile app to monitor your work, devices pair directly through a secure relay. No ports are exposed to the public internet.

The Role of Context Windows

To understand what Copilot does with your code, you must understand the context window. Modern LLMs can process thousands of lines of code at once. The extension constantly scans your project to find related functions, classes, or documentation to include in the prompt.

This "RAG" (Retrieval-Augmented Generation) process is what makes the AI feel smart. However, it also means that code from a file you are not currently editing might be sent to the cloud. Developers should be aware that the scope of data transmission often extends beyond the active line of code.

Managing Security Risks in AI Workspaces

If you are concerned about code leakage, there are several steps you can take to harden your environment.

1. Review Extension Settings: Check if "Help improve our products" or similar telemetry options are enabled.
2. Use .ignore Files: Some tools respect specific ignore files to prevent sensitive directories from being scanned by the AI.
3. Audit Your Plugins: Each extension in your IDE may have a different privacy policy. Centralizing your AI work into a dedicated workspace like Deska can help manage these permissions more effectively.
4. Monitor Network Traffic: Using a firewall can show you exactly where your IDE is sending data.

Deska provides a command palette and various panels to help you manage your workflow. By using the Ask Deska assistant, you can drive the workspace through voice or chat to open specific terminals or check sessions without manually navigating complex menus that might trigger unwanted background scans.

Frequently Asked Questions

Does GitHub Copilot store my code?

For individual users, code snippets may be retained for training unless you opt out in the settings. For business and enterprise users, GitHub states that code snippets are not retained once a suggestion is returned. Telemetry data about your interactions is still collected to improve the service.

How can I use AI for code without sending data to the cloud?

You can run small models locally using tools like Ollama or Llama.cpp. While these are less powerful than GPT-4 or Claude, they keep everything on your hardware. Alternatively, using a local-first workspace like Deska ensures that your files and environment stay private, even if you choose to send specific prompts to a cloud model via an API key you control.

Is it safe to use AI coding assistants for proprietary projects?

Safety depends on your company policy and the specific terms of service of the tool. Most professional teams opt for enterprise versions that guarantee no training on their data. It is also helpful to use workspaces that allow for side-by-side comparison of different agents to ensure no single provider has a monopoly on your codebase access.

Getting Started with Private AI Workspaces

If you want to explore a different way of working with AI, you can download Deska for free. It allows you to build a custom workspace using an infinite canvas where you can place terminals, code editors, and AI agents anywhere you like. By maintaining a local-first philosophy, it provides a balance between the power of cloud AI and the security of local development. You can learn more about setting up your first workspace in the getting started guide.