> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kodus.io/llms.txt
> Use this file to discover all available pages before exploring further.

# AI Model Security

> Which AI models process your code, who holds the provider relationship, and what happens to your code during a review.

## Which model reviews your code

There is no single fixed model. **Kodus runs on Bring Your Own Key (BYOK) by default on every
plan**, which means the model — and the provider relationship behind it — is normally yours,
not ours.

<Info>
  We deliberately don't pin model names in this page. The catalog moves fast; for the current
  recommended models see [BYOK](/en/how_to_use/byok), which is generated from what the product
  actually offers today.
</Info>

There are three paths, and which one applies changes who your data agreement is with:

| Path                                    | Who owns the provider account                                     | Which class of model                                                                                                         |
| --------------------------------------- | ----------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
| **BYOK** (default, every plan)          | **You.** Your key, your billing, your contract with the provider. | Whatever you configure — a frontier general-purpose model, a coding-specialized model, or a self-hosted/compatible endpoint. |
| **Trial / no key connected**            | Kodus, for a limited number of reviews.                           | A coding-specialized model we pick, with a smaller open-weights model as fallback.                                           |
| **Enterprise with a Kodus-managed key** | Kodus, under your Enterprise agreement.                           | Frontier general-purpose models, selected by us.                                                                             |

### Supported provider classes

Under BYOK you can point Kodus at:

* **First-party frontier providers** — the major commercial labs, via their own APIs.
* **Cloud-hosted enterprise gateways** — the same frontier models billed through your existing
  cloud account, with that cloud's IAM, region pinning, and data-residency guarantees.
* **Aggregators** — a single billing relationship in front of many models.
* **Any OpenAI-compatible or Anthropic-compatible endpoint** — including specialized coding
  providers and models you host yourself, which never leaves your network.

The full, current list with setup instructions lives in [BYOK](/en/how_to_use/byok).

<Note>
  **A BYOK review never silently falls back to a Kodus-managed model.** If your configured model
  fails and you haven't set your own fallback, the review fails instead — we don't reroute your
  code (or your bill) to our infrastructure.
</Note>

## What Kodus does with your code

* Code is sent to the model provider only to produce that review, and only the parts needed:
  the diff plus the context the review requires.
* Nothing is retained for training by Kodus.
* Review results (suggestions, metadata) are stored so the product can show history, avoid
  repeating suggestions, and compute metrics.

## What the provider does with your code

This is the part worth reading carefully, because **under BYOK it isn't governed by your
contract with Kodus — it's governed by yours with the provider.**

* Most commercial API tiers state they don't train on API traffic by default. Verify this on
  the plan you're actually on: consumer/free tiers often differ from paid API tiers.
* Retention windows (for abuse monitoring, for example) are set by the provider, not by Kodus.
* If you need a contractual guarantee (zero retention, a specific region, a signed DPA), get it
  from the provider directly — or use a cloud-hosted gateway or a self-hosted endpoint, where
  those terms are already part of your existing agreement.

<Warning>
  Because you choose the provider, **Kodus cannot make data-handling promises on their behalf.**
  If your compliance posture depends on specific guarantees, confirm them with your provider
  before pointing Kodus at it.
</Warning>

## Security measures on the Kodus side

* **Key handling**: your provider key is encrypted at rest and never shown back in plain text.
* **Encryption**: data encrypted in transit and at rest.
* **Controlled access**: role-based access to the workspace — see
  [Workspace Roles](/en/how_to_use/workspace_roles).
* **Self-hosting**: run the whole stack in your own infrastructure if you don't want code
  leaving your network at all. See [Deploy Kodus](/en/how_to_deploy/deploy_kodus/generic_vm).

## Self-hosted telemetry

If you run Kodus self-hosted, each instance sends one anonymous daily
heartbeat to `telemetry.kodus.io` with aggregated counters and runtime
metadata — never code, identities, or anything that could trace back to
your users. You can inspect the exact payload with `pnpm run telemetry:preview`
or disable it with `KODUS_TELEMETRY_DISABLED=true`. Full schema, retention
policy, and source code links are documented in
[Anonymous Telemetry](/en/how_to_deploy/deploy_kodus/telemetry).

Questions? Contact our support team or join [Discord](https://discord.gg/TFZBRk9fT6).