Does AI Code Review Send Your Code to a Third Party?

The part that's unavoidable

An AI reviewer has to send the code, or at least the diff, to a language model to get a review back. That's inherent to the category, not a specific vendor's choice. So "does it send my code to a third party" isn't really the useful question. "Which third party, and how many hops does it pass through first" is.

Two different architectures

• Hosted reviewer: the vendor runs a service that receives your repository or pull-request data, and that service manages model access on your behalf. Their server is an additional processor sitting in the data path.
• BYOK Action: the workflow calls the model provider you selected, using a key you supplied, with no vendor server in between the workflow runner and the provider.

Neither shape is automatically safer. What matters is whether you can name every system that touches the code, and whether an extra vendor is one of them.

What a BYOK GitHub Action actually touches

For Private AI PR Reviewer specifically: pull request data moves from the GitHub API to the Anthropic or OpenAI API you selected, on the workflow runner, then the review returns to the pull request through the GitHub API. Provider keys remain GitHub Actions secrets; the Action process and its dependencies can access them, and the unmodified release passes them to the selected provider SDK with no Cody Labs-operated data service anywhere in that path. The third parties involved are GitHub Actions, the GitHub API, and the Anthropic or OpenAI API you chose, nothing else. The workflow requests only contents: read and pull-requests: write.

Questions worth asking any AI reviewer

1. Exactly which systems receive the code, the diff, and the review?
2. Is anything retained by an intermediate vendor, and for how long?
3. Can you choose the provider, model, and account the request actually goes to?
4. Can you inspect the exact source that runs, before you adopt it?