Preventing Data Leaks in AI Coding: 6 Decisions First
Summary: Before customer data or source code goes to AI, decide six things: which tool, which data, training and retention settings, NDA and contract terms, whether the client has permitted it, and the fallback if they have not. Deciding up front costs far less than cleaning up afterward.
Contents
- What should be decided before customer data or source code goes to AI?
- Which AI tool and plan, and what are the training settings?
- Which data must never go into AI, and which needs conditions?
- What should an NDA and contract say about AI?
- What if the client has not permitted AI on their code?
- When are these measures not enough?
- FAQ
1. What should be decided before customer data or source code goes to AI?
Six decisions, and the answers should be on paper before an engineer opens the first AI tool on a client's code. Leaks through AI rarely come from an attacker. More often an engineer pastes a snippet, an error log or real data into a tool that nobody has ever decided is allowed.
| # | Decision | Question to answer |
|---|---|---|
| 1 | Tool | Which tool, which plan, company account or personal |
| 2 | Data | Which data types may go in, which never |
| 3 | Settings | Is it used for training, how long is it kept, where is it switched off |
| 4 | Contract | What the NDA and contract say about AI and about sub-processors |
| 5 | Client permission | Has the client agreed, for which repositories, who signed |
| 6 | Fallback | If the client says no, how is that work done instead |
None of this needs new software, only a short agreement at project start and a few lines of configuration.
2. Which AI tool and plan, and what are the training settings?
What decides whether data is used for training is the plan, not the tool's name. For Claude Code, according to Anthropic's data usage documentation (read Oct 17, 2026), Free, Pro and Max accounts have a setting that allows data to be used to improve models. With it on, data is used for training and kept for 5 years. With it off, it is kept for 30 days. On commercial plans (Team, Enterprise, API and third-party platforms), Anthropic does not train generative models on code or prompts sent through Claude Code unless the customer opts in to a data-sharing program. Standard retention on commercial plans is 30 days, and zero data retention is available only to some qualified Enterprise accounts.
Three practical consequences for a software company:
- Engineers' personal accounts are the biggest risk. Using a personal plan with default settings on a client's code should be banned by policy, not by reminders.
- "Not trained on" does not mean "not stored". Commercial plans still send content to the provider's servers and keep it for 30 days. The engineer's machine also keeps session transcripts as plain text under
~/.claude/projects/, 30 days by default. - Each tool has its own policy. GitHub Copilot is also split by plan. When you ask a vendor, ask per tool and per plan, not just "do you use AI".
3. Which data must never go into AI, and which needs conditions?
Secrets never go into AI. Personal data and client source code go in only under clear conditions. The table is the classification VAON recommends for teams coding with AI.
| Type | Default | Condition to allow |
|---|---|---|
API keys, passwords, tokens, .env files |
Never | None. Block by configuration, not by reminders |
| End users' personal data | No | Purpose is within what was stated, the provider does not use it for machine learning; prefer masked data |
| Real production data | No | Replace with sample or masked data |
| Client source code and specifications | No | Client permits it, on the agreed tool and plan |
| Open source code, public documents | Yes | No special condition |
On personal data, Japan's Personal Information Protection Commission (PPC) issued an advisory on June 2, 2023. It says that if a business enters prompts containing personal data into a generative AI service without the person's consent, and the data is handled for any purpose other than returning a response, the business may violate the Act on the Protection of Personal Information (APPI). So it asks businesses to confirm that "当該生成AIサービスを提供する事業者が、当該個人データを機械学習に利用しないこと等" (the service provider does not use the data for machine learning). Specific cases belong with a lawyer.
Blocking by configuration beats reminders. Claude Code's settings documentation gives an example using permissions.deny with Read(./.env) and Read(./.env.*) so the AI cannot read environment files. For GitHub Copilot, content exclusion is available on Business and Enterprise plans, but the documentation states it is currently not supported in the Edit and Agent modes of Copilot Chat in Visual Studio Code and some other editors, and does not apply to symlinks. Anyone who believes "we excluded those files" should read that part.
4. What should an NDA and contract say about AI?
They should say how AI is used, because NDAs drafted before the AI era usually do not mention AI tools. Four items belong in them: the permitted tool categories (and a duty to tell the client when tools change); the data types allowed and forbidden; where the AI provider processes data, how long it keeps it and whether it trains on it; and what happens at the end, including revoking access and handing over or deleting data at the client's request.
With personal data, the AI provider may become a link in the processing chain. That needs confirmation from the client's legal team or lawyer, not a conclusion from the engineering team.
VAON's experience follows the project lifecycle. Before starting, both sides sign an NDA and agree which data may be used and who may see it. During the work, access is granted by role, code can sit on the client's own repository, and VAON does not put data or code into an AI tool without permission. At the end, VAON revokes access and hands over or deletes data on request. The shared Claude Code configuration is managed by the company, and it keeps real keys out of development environments.
5. What if the client has not permitted AI on their code?
If the client has not permitted it, VAON does not put their code into AI tools, and that work runs through a process without AI. The AI security review does not run; what remains is three automated gates on each pull request (secret scanning, dependency scanning, static analysis) plus human review. The same-series article "AI Coding Security: What Japan's Advisory Asks of Software Vendors" describes these gates in full.
The other AI-assisted work, such as re-reading code, generating tests and syncing documents, does not apply to code that is not permitted. That work moves to people, so the schedule needs recalculating. Telling the client up front, with options, is easier than telling them later.
When asking for permission, offer options rather than a yes/no question: no AI on this code (schedule counted as manual work), or AI on named repositories, with the agreed tool and plan. Some clients also want data to pass through their own cloud account. According to the documentation, Claude Code can run through Amazon Bedrock, Google Cloud's Agent Platform or Microsoft Foundry, which makes it worth raising.
6. When are these measures not enough?
These measures reduce the chance of leakage. They do not bring it to zero. Four limits worth stating to clients:
- Data already sent cannot be recalled. Correct settings only protect the next time. Content already sent stays within the provider's retention period.
- Blocking configurations have gaps. Claude Code's sandbox covers shell commands only. Per the documentation, file tools, MCP servers and hooks run outside it, and native Windows has no sandbox. Copilot's content exclusion may still receive information indirectly through the IDE, according to GitHub's own documentation.
- Data that must never leave the internal network. Then an external AI provider is the wrong fit, even on a commercial plan. You need a system running inside the client's network, such as a chatbot that does not use company data for training.
- Policy cannot replace people. No policy stops an engineer who deliberately does the wrong thing. Role-based access and review records help detect it; they do not guarantee prevention.
7. FAQ
Is switching on "do not use my data for training" enough? No. That setting only says whether the provider trains on the content. The content is still sent and kept for the plan's retention period, 30 days on Claude Code's commercial plans. Data that must stay completely private should not be sent.
May an engineer use a personal AI account on a client's code? They should not. Personal plans may allow data to be used for training, and the company cannot control the settings. Policy should require a company-issued account on a commercial plan, with a tool the client has accepted.
Do NDAs we already signed need changing? Review them. NDAs written before the AI era usually cover disclosure to third parties, not entering content into an AI service. A short AI addendum is neater than re-signing the whole document.
What should be recorded once the client permits AI? Four things: the agreed tool and plan, the repositories or data types permitted, who on the client side agreed, and the date. When people change on the client side, this record spares both parties an argument.
Considering letting a software company use AI on your source code or data? In the free 60-minute session with our CEO, VAON explains how it agrees terms at project start and what the options are if you do not want AI used. Book a free 60-minute consultation
See also: Rules for using Claude Code at work, Security questions before bringing an AI chatbot into your company, and the overview, 12 things to check before outsourcing AI-driven development.
References
- Anthropic, Claude Code Docs, Data usage: https://code.claude.com/docs/en/data-usage (opened Oct 17, 2026)
- GitHub Docs, Content exclusion for GitHub Copilot: https://docs.github.com/en/copilot/concepts/context/content-exclusion (opened Oct 17, 2026)
- Personal Information Protection Commission (Japan), "Cautionary notice on the use of generative AI services" (Japanese), Jun 2, 2023: https://www.ppc.go.jp/files/pdf/230602_alert_generative_AI_service.pdf (opened Oct 17, 2026)
Author: Đoàn Minh Hoàng, Co-Founder & CTO, VAON.
