Enterprise Security Assessment
Ampcode & Sourcegraph
Prepared for: Chief Information Security Officer
Assessment Date: March 19, 2026
Classification: Internal — Restricted Distribution
Scope: Ampcode AI Coding Agent · Sourcegraph Code Search Platform
Security Posture Overview
Ampcode is an AI-powered coding agent built by Sourcegraph, Inc. — a company trusted by Reddit, Uber, Dropbox, Databricks, and other Fortune-500 engineering organizations. This assessment evaluates Ampcode and Sourcegraph's security posture against enterprise requirements.
Compliance Certifications
SOC 2 Type II · ISO/IEC 27001:2022 · GDPR · CCPA · EU AI Act compliant. Annual third-party penetration testing across full stack.
Verified
Data Protection
Enterprise plan provides zero data retention on all LLM providers. AES-256 encryption at rest. TLS 1.2+ in transit. No model training on customer data.
Enterprise-Grade
Infrastructure
Hosted on Google Cloud Platform (US). Terraform-managed infrastructure. Segregated customer environments. All US-based service providers — no China-based infrastructure.
Hardened
Authentication & Access
Enterprise SSO via Okta/SAML/OIDC. Directory Sync (SCIM) for auto-provisioning. Audit logging. Role-based workspace controls.
Enterprise SSO
Certifications & Third-Party Assessments
Sourcegraph maintains a comprehensive compliance program verified by independent auditors. All certifications and reports are available through the Security Trust Portal and Amp Trust Portal.
Security Assessments
- Annual third-party penetration testing (full stack: clients, backend, infrastructure)
- Containers scanned for CVEs using GCP-native tooling
- Software components monitored continuously for CVEs
- Internal security audits conducted regularly
- Signed SBOMs published for container images
Security Development Lifecycle
- Mandatory code reviews for all changes
- Security-sensitive changes reviewed by security team
- End-to-end auth/authz test coverage
- Secrets managed via vault — never in code
- Distroless Docker images for minimal attack surface
- Secure software supply chain practices
Ampcode — Component Architecture & Data Flow
Ampcode operates as a two-component system. The client runs locally; the server is a multi-tenant cloud service. The client never clones, indexes, or stores the entire codebase — only relevant snippets are sent as LLM context.
CLI / VS Code
TLS 1.2+
ampcode.com (GCP)
TLS 1.2+
Anthropic · OpenAI · Google
Amp Client (Local)
- Provides local code context management
- Stores credentials in secure local path
- Best-effort avoidance of
.envand credential files - Automatic secret redaction before transmission
- Communicates only with
ampcode.comdomains
Amp Server (Cloud)
- Hosted on GCP with PostgreSQL (encrypted)
- Handles auth, workspaces, thread storage
- Proxies LLM inference — does NOT store entire codebase
- Stores only partial code snippets in thread data
- Thread deletion removes data within 30 days
Data Protection, Retention & Encryption
Enterprise-grade data protection with zero LLM retention, volume-level encryption, and granular thread lifecycle management.
Encryption Standards
- In Transit: TLS 1.2+ for all traffic
- At Rest: AES-256 volume-level encryption
- Backups similarly encrypted
- GCP-managed encryption keys
Zero LLM Data Retention (Enterprise)
- Enterprise plan: zero data retention on ALL LLM providers
- No input/output text retained beyond inference time
- Images: extremely limited retention for AUP compliance only
- Amp does NOT train models on your data
- Training can never be enabled on Enterprise plans
Thread Data Lifecycle
- Thread data: messages, LLM responses, code snippets, attachments
- Deleted threads: data removed within 30 days
- Enterprise workspace threads owned by the organization
- Private thread mode prevents workspace sharing
- User deletion triggers personal thread cleanup
Data Residency & Scope
- All data stored and processed in the United States
- No infrastructure or providers based in China
- Client never stores entire codebase
- Only "partial code data" (snippets/files) sent as context
- No personal data sold or shared for cross-contextual advertising
Cloud Infrastructure & Operational Security
Sourcegraph's infrastructure is hosted entirely on Google Cloud Platform, managed via Terraform, with defense-in-depth security controls.
Infrastructure Hardening
- 100% hosted on Google Cloud Platform (US regions)
- Infrastructure-as-Code via Terraform
- Segregated GCP environments per customer instance
- All storage volumes encrypted at rest
- Data encrypted in transit (code host ↔ cloud)
- Firewall-restricted external access to production
- Secrets stored in encrypted local drives or secret management service
- Distroless Docker containers for minimal attack surface
Access Control
- Just-in-time access provisioning
- Group-based permissions (least privilege)
- Multi-factor authentication for all internal systems
- Regular access reviews and revocation
- SSO access for employee production access (logged & monitored)
Monitoring & Incident Response
- 24×7×365 service availability monitoring
- 24×7×365 alert investigation and attack triage
- Centralized service, application, and access logs
- Log retention up to 365 days
- Formal Security Incident Response Policy
- Only restricted employees access customer instances
- All access logged and monitored
Network Security
- Cloudflare WAF (Web Application Firewall)
- Cloudflare Rate Limiting
- DNS managed via Cloudflare
- Monthly instance updates
- Security patches per Vulnerability Management Policy
Authentication, SSO & Audit Logging
Ampcode Enterprise provides full enterprise-grade identity management including SSO, SCIM directory sync, and comprehensive audit logging.
Single Sign-On (SSO)
- SSO via Okta, SAML, OAuth, OpenID Connect
- SSO can be set as exclusive auth method (disable passwords)
- Powered by WorkOS
- HTTP Proxy auth also supported (self-hosted)
- Workspace Admin configuration dashboard
Directory Sync (SCIM)
- Automatic user provisioning on join
- Automatic de-provisioning on leave
- Group-based access management
- Syncs with identity provider directory
- Configured via Workspace Settings
Audit Logging
- Authentication event logs for Workspace Admins
- Comprehensive application audit logs (timestamps, actors, requests)
- Audit logs retained minimum 30 days
- Enterprise logs available on request for customer audits
- Internal monitoring by Amp security team
ampcode.com,
auth.ampcode.com,
authapi.ampcode.com.
See Client Security documentation.
Automatic Secret Redaction
Ampcode includes built-in automatic secret detection and redaction at the lowest level of the system, preventing secrets from reaching LLMs, storage, or external services.
Supported Secret Types
- Cloud Providers: AWS, Google Cloud, Azure credentials
- Dev Platforms: GitHub, GitLab, Sourcegraph, Amp tokens
- LLM Providers: OpenAI, Anthropic, HuggingFace API keys
- Common Services: Stripe, Slack, npm tokens
- Generic Patterns: API keys, webhook secrets, password fields
How It Works
Detected secrets are replaced with markers like:
[REDACTED:amp]
Redaction occurs before data leaves the client — secrets never reach the LLM, local cache, or server.
Secret redaction may not catch:
• Secrets in non-standard or custom internal formats
• Secrets that don't follow recognizable patterns
• Encoded or obfuscated secrets
If a secret is not redacted:
1. Edit the preceding message and resend (overwrites on server)
2. Mark thread as private
3. Rotate the exposed secret immediately
Client File Protections
- Best-effort avoidance of
.envfiles - Best-effort avoidance of other credential files
- Credentials stored locally at secure path
- New secret types added regularly — contact support to request
Infrastructure & Service Providers — Data Exposure Map
Complete mapping of all third-party providers, their locations, and what data they can access. All providers are US-based. No China-based infrastructure.
| Provider | Location | Data Exposure | Purpose | Risk Level |
|---|---|---|---|---|
| Google Cloud Platform | 🇺🇸 USA | Partial Code | Primary infrastructure, PostgreSQL, storage | Low |
| Anthropic (Claude) | 🇺🇸 USA | Partial Code | Primary LLM inference | Low |
| OpenAI | 🇺🇸 USA | Partial Code | LLM inference (select models) | Low |
| Google Vertex AI | 🇺🇸 USA | Partial Code | Gemini / Claude inference | Low |
| Amazon Bedrock | 🇺🇸 USA | Partial Code | Claude inference | Low |
| xAI | 🇺🇸 USA | Partial Code | LLM inference | Low |
| Fireworks | 🇺🇸 USA | Partial Code | Proprietary Amp model features | Low |
| Baseten | 🇺🇸 USA | Partial Code | Proprietary Amp model features | Low |
| Cloudflare | 🇺🇸 USA | Metadata Only | WAF, DNS, Rate Limiting | Low |
| WorkOS | 🇺🇸 USA | No Code | Authentication, SSO, User management | Low |
| Parallel | 🇺🇸 USA | No Code | Web search / page retrieval | Low |
| Stripe | 🇺🇸 USA | No Code | Billing & payments | Low |
| Sparkpost / Bird | 🇺🇸 USA | No Code | Email delivery (10-day header retention) | Low |
| Sentry | 🇺🇸 USA | Error Data | Error monitoring / debugging | Low |
Enterprise Risk Matrix
Residual risk assessment after considering Ampcode's security controls. All identified risks are within acceptable enterprise thresholds.
Data at Rest Exposure
AES-256 encryption, GCP-managed keys, segregated environments. Thread data deleted within 30 days of deletion request.
Data in Transit Exposure
TLS 1.2+ enforced on all connections. Cloudflare WAF provides additional protection. No plaintext transmissions.
LLM Provider Data Leakage
Enterprise zero-retention agreements with all LLM providers. No model training on customer data. Training permanently disabled on Enterprise plans.
Authentication Bypass
Enterprise SSO with SCIM, MFA-enforced, exclusive SSO mode available. Annual penetration testing validates auth controls.
Secret Exposure via LLM Context
Automatic redaction is best-effort — non-standard secrets may pass through. Mitigation: Developer training, secret rotation policy, custom secret pattern requests.
Prompt Injection / LLM Manipulation
Inherent to all LLM-based agents. Ampcode has bash/tool execution capabilities. Mitigation: User approval for destructive actions, bug bounty program covers prompt injection.
Insider Threat (Vendor)
Restricted employee access, JIT provisioning, SSO with MFA, access logged and monitored. Regular access reviews.
Compliance & Regulatory Risk
SOC 2 Type II, ISO 27001:2022, GDPR, CCPA, EU AI Act compliant. All data in US jurisdiction. No China-based providers.
What Ampcode Secures vs. What You Must Secure
Like all cloud services, Ampcode operates under a shared responsibility model. Security is a partnership — here is exactly what the vendor handles versus what your organization must own.
🟢 Sourcegraph / Ampcode Responsibility
- Application security (secure SDLC, code reviews, pentesting)
- Infrastructure security (GCP hardening, firewall, WAF)
- Encryption at rest (AES-256) and in transit (TLS 1.2+)
- LLM provider zero-retention enforcement (Enterprise)
- Automatic secret redaction engine
- 24/7/365 monitoring and incident response
- SOC 2, ISO 27001 compliance maintenance
- SSO/SCIM infrastructure and authentication security
- Audit logging infrastructure
- Security patch management and vulnerability remediation
- Bug bounty program operation
- Secure software supply chain (SBOMs, distroless images)
🟡 Your Organization's Responsibility
- Access token management — secure storage, rotation, and revocation of tokens
- Code host connection configuration — ensure correct repositories are linked and permissions are properly set
- User access management — control who has access to your workspace and data
- Repository permission configuration — enforce code host permissions
- Secret hygiene — don't hardcode secrets; use vaults; train developers on non-standard secret risks
- Thread privacy management — mark sensitive threads as private; review shared thread content
- MCP server trust decisions — evaluate third-party MCP extensions before installation
- Compliance awareness — understand how code sharing impacts your regulatory obligations
- Developer training — educate teams on AI agent risks, prompt injection, and data exposure
- Corporate proxy/firewall config — allowlist required Amp domains
- Incident response coordination — maintain playbooks for secret exposure in LLM contexts
• Never paste production secrets, credentials, or PII directly into prompts
• Review agent-suggested commands before execution — especially
rm, curl, git push, and network operations• Use
.env files and vault-based secret management — Amp best-effort avoids reading these• Rotate any secret that may have been inadvertently exposed in a thread
• Report any security concerns to security@ampcode.com
CISO Action Items & Security Verdict
Pre-Deployment Checklist
- Request and review SOC 2 Type II report via Trust Portal
- Request and review latest penetration test report via Amp Trust Portal
- Confirm Enterprise plan activation (zero LLM data retention)
- Configure SSO as exclusive authentication method
- Set up SCIM Directory Sync with corporate IdP
- Verify training is permanently disabled (Enterprise default)
- Allowlist
ampcode.com,auth.ampcode.com,authapi.ampcode.comon corporate proxy - Review and approve subprocessor list at sourcegraph.com/terms/subprocessors
- Establish secret rotation playbook for LLM-context exposure
- Develop developer training program for AI agent security
- Request application audit logs for initial baseline review
- Review Amp Privacy Policy with Legal/DPO team
Security Verdict
RECOMMENDED FOR ENTERPRISE USE
Ampcode/Sourcegraph demonstrates a mature enterprise security posture with SOC 2 Type II certification, ISO 27001:2022, comprehensive encryption, zero LLM data retention on Enterprise plans, SSO/SCIM support, and a well-defined shared responsibility model. All infrastructure is US-based with no China-based providers.
Conditional on: Enterprise plan activation, SSO enforcement, developer training completion, and regular audit log reviews.
General: security@ampcode.com
Vulnerability Disclosure: disclosure@ampcode.com
Bug Bounty: ampcode.com/security — Bug Bounty
Status: sourcegraphstatus.com
Privacy: privacy@sourcegraph.com
Reference Links & Source Documentation
| Document | URL | Type |
|---|---|---|
| Ampcode Security Reference | ampcode.com/security | Primary Source |
| Sourcegraph Security Page | sourcegraph.com/security | Primary Source |
| Sourcegraph Security Trust Portal | security.sourcegraph.com | SOC 2 / Pentest / ISO |
| Amp Trust Center | trust.ampcode.com | SOC 2 / Reports |
| Privacy Policy | sourcegraph.com/terms/privacy | Legal / Privacy |
| Subprocessors List | sourcegraph.com/terms/subprocessors | Data Processing |
| System Status | sourcegraphstatus.com | Operational Status |
| Terms of Service | sourcegraph.com/terms | Legal |
| SBOM Documentation | sourcegraph.com/docs/cli/how-tos/fetch_sboms | Supply Chain |
| Repository Permissions | sourcegraph.com/docs/admin/permissions | Configuration |
| No BYOK Policy | ampcode.com/news/no-more-byok | Architecture Decision |
© 2026 — CISO Security Assessment Report — Prepared with Ampcode
This document is based on publicly available security documentation and should be supplemented with direct vendor engagement, NDA-protected document review (SOC 2, pentest reports), and internal risk committee evaluation.