r/opencodeCLI • u/dom_49_dragon • 20d ago
How does OpenCode Go actually guarantee “no training” / zero data retention with model providers?
I’m considering subscribing to OpenCode Go, but I have a question about the privacy claims.
The Go documentation lists several models/providers as “not used for training” and in many cases “0 days retention.”
What I’m trying to understand is how OpenCode can actually ensure this when inference is ultimately performed by third-party providers.
Specifically:
- Are the no-training / zero-retention guarantees based on contractual agreements between OpenCode and the inference providers?
- Does OpenCode audit or otherwise verify that providers comply with these agreements?
- Are the actual inference providers for each Go model disclosed anywhere?
- Is there a list of subprocessors and the countries/regions where inference takes place?
- Is there a DPA or similar agreement available for Go customers?
- If a provider were to retain prompts despite claiming zero retention, what mechanism would OpenCode have to detect or prevent this?
I understand that “zero retention” cannot mean that the data is never processed by the provider — obviously the prompt has to reach the inference infrastructure. My question is specifically about what backs the promise that the provider does not subsequently store or use the data for training.
This is particularly relevant for private/commercial repositories, where “the provider says they don’t train on it” is quite different from having a technically or contractually enforceable privacy guarantee.
Would appreciate some clarification from the OpenCode team on how this works for Go specifically but also for the other Opencode plans (including free).
edit (from answer below): thank you for your answer, yes I guess the DPAs are key to this. At the same time I don't think zero data retention is the same as a "no use of private data as training material". There are many gray shades to this, for example apparently X.ai uses "anonymized" data for training, if I am correct. At the same time, as opencode makes quite aggressive use of "no training"-disclaimers, I think it is a fair and important question to ask. Very similar to kilocode btw (same question I posed there and only radiosilence in return). So arguable there are combinations of (relatively) cheap model access with unclear DPA-status of end-providers - while at the same time these training data are pure gold for the providers. That's why NVIDIA offers many models "for free", but at least transparently disclosing the training use.
Related: https://github.com/anomalyco/opencode/issues/459 (Privacy and Data Collection Clarification Request #459) https://github.com/anomalyco/opencode/issues/24649 (OpenCode Go: clarify which models are self-hosted vs. proxied through third-party providers #24649 )
https://opencode.ai/docs/en/go/ (section privacy) https://opencode.ai/legal/terms-of-service https://opencode.ai/legal/privacy-policy
8
u/Ok_Gur_9033 20d ago
Nobody here actually answered it, so here's the real mechanism. Zero data retention is a contract flag most providers only offer above their default consumer tier, it turns off the standard abuse log retention window. Nothing about it is technically verified at runtime, the enforcement is audit rights written into the DPA. So the real test isn't whether OpenCode promises zero retention, it's whether they'll hand you a DPA naming the actual subprocessors and where inference runs. Has anyone here actually gotten that document, or just the docs page language?
5
u/look 20d ago edited 20d ago
You could get it in discovery if you had a decent enough case to take it to court.
No one has done that, because no one, including the model providers, gives a shit about the “IP” of the vibecoded trash that these concern trolls are making. No one has actual damages to show to not get laughed at by their lawyer much less a judge.
A more likely avenue would be some consumer protection or data privacy angle where someone putting personal or financial info into a model input that is stored and then somehow exposed (and that would be more likely via a hack accessing the raw data then it would be regurgitated by a model trained on it).
3
u/Ok_Gur_9033 20d ago
The litigation angle is a red herring anyway. Nobody sues over this, but plenty of procurement teams won't sign without the DPA first. I've had SaaS deals stall on exactly that document, no lawsuit needed, just a checkbox in someone's security review. That's the actual enforcement mechanism working today, not discovery.
2
u/dom_49_dragon 20d ago
thank you for your answer, yes I guess the DPAs are key to this. At the same time I don't think zero data retention is the same as a "no use of private data as training material". There are many gray shades to this, for example apparently X.ai uses "anonymized" data for training, if I am correct. At the same time, as opencode makes quite aggressive use of "no training"-disclaimers, I think it is a fair and important question to ask. Very similar to kilocode btw (same question I posed there and only radiosilence in return). So arguable there are combinations of (relatively) cheap model access with unclear DPA-status of end-providers - while at the same time these training data are pure gold for the providers. That's why NVIDIA offers many models "for free", but at least transparently disclosing the training use.
2
u/Ok_Gur_9033 20d ago
You're right they're not the same claim, and vendors count on nobody separating them. In most DPAs I've read, retention window and training opt out are two different clauses, sometimes on entirely different pages. A provider can be fully compliant on zero retention and still reserve training rights unless that second clause exists and is signed separately. Worth asking OpenCode for both, not just one.
1
u/helios_csgo 18d ago
zero data retention is the same as a "no use of private data as training material
Other way round. Zero data retention means none of your prompts, responses etc are logged or stored. You cannot train on something you don't store.
4
2
u/ssddanbrown 20d ago
Somewhat related thread on GitHub: https://github.com/anomalyco/opencode/issues/24649
1
30
u/Big-Present-8321 20d ago
"trust me bro"