---
title: "Know what the agent tool does with your · Agent Wranglers"
url: https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/tool-data-terms
id: AID-31
level: Required
risk: data
updated: 2026-10-27
build: a2a6bdfed830
tokens: 809
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Know what the agent tool does with your code

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: AID-31
- Level: Required
- Chapter: [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md)
- Rule: Before an agent reads code or data held for a customer or under a confidentiality agreement, confirm the provider's terms. It must not train on that code and must keep it no longer than the agreement allows.
- Check: The account settings of every agent tool the team uses show training on your data turned off. A note in the repository names each tool, its retention period and the plan it runs on. For each customer project, the note links the contract clause the retention period meets.
- Risk: Data leaked or lost
- How: Coding agents send the files they read to the provider's servers. Some plans train on your data unless you turn it off. Choose a business plan or setting that turns off training on your data. Compare the retention period with each customer contract and confidentiality agreement. Write down the retention period. Keep customer data out of the project folder, as the rule above on production credentials says. Record what you find as [Record the data terms of every AI provider](https://agentwranglers.se/playbook/compliance/processors-and-transfers/ai-provider-terms.md) says.

## Sources

- [Claude Code, data usage](https://code.claude.com/docs/en/data-usage)
- [GDPR Article 28 on processors](https://eur-lex.europa.eu/eli/reg/2016/679/oj)

## Related rules

- CMP-19 [Record the data terms of every AI provider](https://agentwranglers.se/playbook/compliance/processors-and-transfers/ai-provider-terms.md) in Compliance and governance
- AID-69 [Roll agents out to a team in steps](https://agentwranglers.se/playbook/ai-assisted-development/running-agents-at-scale/agent-rollout.md) in AI-assisted development
- TDD-2 [Work from read-only access and delete copies afterwards](https://agentwranglers.se/playbook/due-diligence/scope-and-conduct/read-only-and-delete.md) in Technical due diligence

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/tool-data-terms">Agent Wranglers AI-assisted development playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Run agents in CI only for trusted people](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/ci-agents-trusted-triggers.md)
- Next: [Log what every agent session does](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/agent-activity-log.md)
- [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md)