Processing, not retention.
Source code and request context are not retained after model processing.
Security & Trust Center
Your intellectual property. Not training data.
Bring AI into your engineering workflow without turning proprietary code into model training data. Zero Data Retention, no training by Lurus or connected model providers, and control over agent actions.
Code protection, at the core.
ISO/IEC 27001 & C5: hosting-infrastructure assurances.
Select a tile. See what protects your next prompt.
Your expertise stays yours.
No training on customer data, by Lurus or connected model providers.
Capability needs permission.
Manage approvals for file access, tools and commands in your workspace.
Understand the data flow
Know what leaves your workspace. And what happens next.
AI coding is not local-only processing. Requests travel through Lurus to the selected model route. Here is the boundary that matters.
-
Your workspace
Your repository and local session history are the starting point.
-
Required context
The request and relevant context are sent through Lurus. Model-provider transport uses TLS 1.2+.
-
Selected model
The provider processes the request in the region shown for that route. ZDR and no training apply.
-
Back to your workflow
The response returns to your session. The agent’s next tool actions follow the permission system.
The commitments behind the product
Clear promises. Explicit scope.
Know what each commitment covers. Review the scope, responsible team and source behind Lurus Code’s data-protection promises.
Source code storage
Lurus Code processes source code and request context with Zero Data Retention.
Context required for a request is transmitted solely for processing and is not retained after processing is complete.
Privacy policy and DPAModel training
Customer data and source code are not used to train AI models.
The no-training guarantee applies to Lurus and every model provider connected through Lurus Code.
Model and provider overviewRetention and region
Zero Data Retention applies by default to every model and provider route.
Model, provider, and processing region are disclosed transparently for each route without limiting the Zero Data Retention guarantee.
Model and provider overviewProcessing regions
Choose the model. Know the route.
An EU-hosted route and a US-hosted route are not the same data location. Lurus Code shows providers and regions in the model library so your team can make an informed choice.
EU route
European model hosting
Choose an EU-hosted route when European model processing is part of your requirements. Check the specific model and provider in the catalog.
US / global route
Global model access
Other offered routes process in the US or globally. They retain the published ZDR and no-training commitments, but should be reviewed against your transfer requirements.
On every offered model route
Zero Data Retention · No training on customer dataProcessing regions and sub-processors are disclosed for each model route. Find the applicable terms in the DPA and privacy policy.
Compare models and processing regionsInfrastructure assurance
Hosting infrastructure. Established security standards.
ISO/IEC 27001 and C5 provide the framework for the hosting-infrastructure commitment. The scope is the hosting environment, distinct from the application and selected model route.
Discuss infrastructure evidenceCertified hosting infrastructure
Attested hosting infrastructure
Hosting infrastructure: ISO/IEC 27001 certified and C5 attested.
For your vendor review, request the relevant infrastructure scope and evidence. These assurances concern hosting, not a separate product certification for Lurus Code.
From evaluation to approval
Give your reviewers something concrete.
Put the processing terms, model routes and agent controls in front of your reviewers. Our privacy team supports route-specific and infrastructure questions.
Data Processing Agreement Processing responsibilities, obligations and contractual terms. Privacy policy AI processing, data handling and data-subject rights. Models & providers Model capabilities, providers and processing regions. Permission system Tool access, approval scopes and saved decisions. Terms of service Conditions for using Lurus Code.
View the DPA sub-processor annex Published annex: March 2026, listing EU/EEA routes. Before approving US or global processing, ask our privacy team to confirm the applicable sub-processor and transfer documentation.
The questions your reviewers will ask.
Is our code used to train AI models?
No. The published no-training commitment covers customer data and source code at Lurus and connected model providers.
Does Zero Data Retention also apply to US-hosted models?
Yes. ZDR is a published requirement for every offered model and provider route, including US-hosted routes. It does not make a US route an EU-hosted route.
Does ZDR mean there is no local history or account data?
No. ZDR concerns source code and request context after model processing. Local session history and account, usage or billing records are different data categories. Consult the privacy policy for their handling.
Is every request processed within Europe?
No. Processing depends on the selected model and provider route. The model library includes EU-hosted and US or global routes. Review the chosen route against your organization’s requirements.
Is a Data Processing Agreement available?
Yes. The published DPA covers processing responsibilities and contractual terms, with a sub-processor annex. Contact the privacy team to confirm the documentation applicable to your specific model route before approval.
Do the ISO/IEC 27001 and C5 assurances certify Lurus Code itself?
No. The published statement refers to the hosting infrastructure: ISO/IEC 27001 certified and C5 attested. It is not a claim of application or product certification for Lurus Code.
Do model privacy commitments cover external tools automatically?
No. Model processing and agent actions are different trust boundaries. Review permissions and the behavior of shell commands, MCP servers, hooks and web tools separately. The permission system is not a complete operating-system sandbox.
Your next step should be an informed one.
Bring your data-protection requirements, preferred model route and rollout questions. Review the fit before you open access across your organization.
Or explore Lurus Code in a one-week free trial. Start your free trial