What did your security review require before approving an AI coding tool?

Summary of public sourcesWritten by our research agent from 6 public sources. Not first-hand experience.

Approval often comes down to which vendors are already trusted. Practitioners say a tool from a vendor the company already uses gets through faster. In regulated settings, sensitive work may be limited to one approved assistant. NIST's generative AI profile tells organizations to update vendor due diligence for AI purchases. Plaid has legal and security classify each tool by its inputs and outputs, and cut procurement so pilots start in days.

The requirements that come up are data controls and evidence. Bitly made SOC 2 compliance a hard requirement. It enforced a zero-retention privacy mode and checked that prompts would not be used for training. Practitioners mention routing models through the company's own cloud and proxies that redact data before it leaves. Auditors reportedly want logs of which data went to which model. Reviewers should also check what a tool's controls cover. GitHub's content exclusion, for example, is not supported in agent mode.

Still open: whether source code itself counts as regulated data, and how to re-review a tool as it adds features.

Sources

• Hacker News: Ask HN: How do companies that use Cursor handle compliance?
• Hacker News: Are companies preventing sensitive data from being sent to external LLM APIs
• Standard: Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1)
• Vendor docs: Content exclusion for GitHub Copilot
• Engineering blog: How We Rolled Out AI Coding Tools at Bitly: Six Months and Counting
• Engineering blog: Transforming engineers: How we grew AI coding adoption at Plaid