FlowGuard position · AI & exposure
The code already left the building. Years ago.
Every tool in a modern stack sends source code to a third party that decrypts it, processes it, and promises in a contract not to keep or misuse it. A scoped AI reasoning layer is the same arrangement. This is the argument we make when a security team asks whether adding AI-in-the-loop changes their exposure — and where, honestly, the comparison stops.
A note on scope. This page is about the general question of where source code travels in a modern toolchain. It is not a statement about how FlowGuard handles your data — FlowGuard runs Claude on a private Azure AI Foundry with no public API and no training on your code. For that, see Data handling.
Figure 1 · The perimeter
Every arrow below already crosses the line.
Source code does not stay in the repository. It is copied, cloned, uploaded, scanned and rebuilt across external providers, each processing it in cleartext under a contract. Adding a reasoning assistant does not open a new door. It joins a queue.
Summary of the diagram: five third parties already receive the source code and are approved — GitHub Enterprise Cloud, Azure DevOps, SonarQube Cloud, hosted CI/CD runners, and IDE extensions. A sixth destination, a scoped read-only AI (Claude), joins the same queue under the same class of contract rather than opening a new door.
Repository, working copies on developer laptops, build artifacts.
6 contracts
0 technical walls
Figure 1b · What is already out there
It was never only the code.
Azure DevOps does not hold a repository. It holds the project: requirements, acceptance criteria, architecture decisions, sprint plans, incident history, pipeline definitions and the variable groups that carry build secrets. The intellectual property people worry about handing to an AI is, in almost every case, already sitting in a work item.
Figure 2 · Control equivalence
The same assurances, from the same auditors.
Vendor risk does not assess “is this technology safe.” It assesses certifications, contractual terms and data handling. Scored on that basis, the AI vendor does not sit below the providers already in production — on AI-specific governance it sits above them.
| Provider | SOC 2 Type II | ISO 27001:2022 | ISO 42001 (AI) | Encrypted in transit & at rest | Data residency | Retention controls | Not used to train |
|---|---|---|---|---|---|---|---|
GitHub Enterprise Cloud Repository hosting | Yes | Yes | Not applicable | Yes | Yes | Yes | Yes |
Azure DevOps Microsoft compliance program | Yes | Yes | Not applicable | Yes | Yes | Yes | Yes |
SonarQube Cloud Multi-tenant SaaS on AWS | Yes | Yes | Not applicable | Yes | Yes | Yes | Yes |
Anthropic — Claude Commercial terms · scoped analysis | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
Figure 3 · Where the comparison stops
Differences survive. None of them is about exposure.
The usual objection — that a conversation carries architecture and reasoning, not just files — does not survive Figure 1b. What remains is about governance, record-keeping and underwriting — conditions a team can meet, not exposures a contract can't cover.
Difference one
No per-item record of what was sent
Azure DevOps logs who opened which work item. A conversation has no equivalent inventory, so scope is enforced by policy and channel logging, not reconstructed afterwards. An auditability gap — not an exposure gap.
Difference two
Consumer accounts
Everything here describes a contracted enterprise deployment. Personal accounts carry none of these terms — and that is the risk behind nearly every publicised leak.
Difference three
Agentic use is a separate review
Read-only reasoning is one thing. Letting a tool run commands or write files changes the analysis and deserves its own assessment.
Difference four
Track record and novelty
A newer vendor, or a novel processing mode, carries different residual risk even under identical paper. That is real — but it is an underwriting question about maturity, not a question of new exposure.
Conclusion
The code is already in third-party hands. The only question is which contract you read carefully.
Refusing the sixth destination while running the first five does not protect the code. It removes the benefit, leaves the exposure exactly where it was, and pushes people toward personal accounts — the one scenario where the contract does not exist. FlowGuard is built on the opposite premise: a scoped, contracted, private AI path you can audit.
Sources: trust.anthropic.com · privacy.claude.com · sonarsource.com/trust-center · GitHub Trust Center · Microsoft Trust Center. FlowGuard's position note. Certification scope changes — confirm current status and your own contract terms before relying on this page.