Last updated: October 18, 2026
This page describes the administrative, technical, and physical controls that protect customer data at Greptile. Our Trust Center has our SOC 2 Type II report, penetration test results, security policies, and current list of subprocessors.
Quick Links
Hosting
Greptile is available as a cloud service or self-hosted in your own infrastructure.
Greptile Cloud
Greptile Cloud is hosted on Amazon Web Services ("AWS"). Information about security provided by AWS is available from the AWS Security website.
Greptile uses third-party LLM providers for AI inference. Every provider that processes Customer Data is listed on the Trust Center, and our zero data retention agreements with LLM providers are available under Resources.
Self-hosted
Self-hosted Greptile runs in your own infrastructure, on-premises or in your virtual private cloud (VPC), so your code never leaves your environment. You can deploy it with Docker Compose on a single Linux host or with a Helm chart on Kubernetes. The self-hosting documentation covers requirements, installation, and upgrades.
Self-hosted customers bring their own LLM provider by configuring its base URL and keys. See LLM providers for the supported options.
Your Code
Greptile stores customer code on an encrypted filesystem on our servers. Code remains cached on our machines until access is revoked in your code host (GitHub, GitLab, Bitbucket, Gitea, Cursor Origin, or Perforce), at which point it is deleted from our servers. Access to the code is tightly controlled and used only to provide the services you have opted into. See code providers for the supported versions of each.
For Greptile Cloud, code is stored on AWS infrastructure provisioned by Greptile.
AI Training
De-Identified Data and AI Training
Greptile may aggregate and anonymize Customer Data ("De-Identified Data") for analytical purposes and to monitor, improve, or expand our services, and may use such data to train and improve artificial intelligence algorithms and models ("AI Training and Learnings").
Greptile will implement appropriate measures and controls designed to remove personally identifiable information, customer-specific references, and sensitive data from De-Identified Data and AI Training and Learnings. Greptile will solely and exclusively own the De-Identified Data and AI Training and Learnings (but not the underlying Customer Data).
Opting Out of AI Training
To opt your organization out of AI training, an organization admin can open Organization Settings, go to Data & Privacy, and turn off Help us improve Greptile.
For customers using our self-hosted solution, no Customer Data is collected or processed for machine learning purposes unless explicitly configured by the customer.
Data Deletion
Administrators can delete all Customer Data stored by Greptile at any time during a subscription term: open Organization Settings and select Delete Organization. Within 24 hours of administrator-initiated deletion, Greptile hard deletes all Customer Data from currently running production systems. Greptile-maintained backups of services and data may be destroyed within 30 days (backups are destroyed within 30 days, except that during an on-going investigation of an incident such period may be temporarily extended).
Within 30 days following any termination or expiration, Customer may request return of Customer Data stored by Greptile (to the extent such data has not already been deleted by Customer).
Compliance and Audits
Greptile is SOC 2 Type II compliant. At a minimum, Greptile will align with prevailing industry standards such as SOC 2 Type II, or any successor or superseding standard.
Internal personnel and respected external security firms regularly assess the Greptile services for vulnerabilities, and we continuously scan our web platform with automated tools.
Request our SOC 2 Type II report, bridge letter, and latest penetration test report from the Trust Center.
Confidentiality and Personnel
Greptile places strict controls over its employees' access to Customer Data. Some employees need access to the systems that store or process Customer Data to operate Greptile, for example to diagnose a problem in a customer's account. These employees may view Customer Data only when necessary, and our technical controls and audit policies log every access to a customer account. All employees and contract personnel are bound by our confidentiality policies.
Greptile conducts background checks on all employees before employment, and employees receive privacy and security training during onboarding as well as on an ongoing basis. All employees are required to read and sign our comprehensive information security policy covering the security, availability, and confidentiality of the Greptile services.
Reporting a Vulnerability
To report a vulnerability, or for security questions the Trust Center doesn't answer, email security@greptile.com.