- Deployment
- on-prem
- Hq Country
- Israel
- Hq City
- Tel Aviv
- Ownership
- private
- Founded
- 2013
- Training Default
- never
- Residency Options
- on-premises Kubernetes cluster on the customer's private network, customer VPC, fully air-gapped installation
- Gov Access Exposure
- mixed
- Eu Ai Act Role
- gpai
- Certs
- SOC 2 (type unverified)
- DPA available
- no
- Zero Retention Available
- Yes
- Self Host Option
- Yes
- Retention Default
- "Tabnine has a no-train-no-retain policy." Context sent for inference — chat history, lines of code, variables, type declarations, related files — "is deleted immediately after the server returns the answer to the client", and the docs state this holds for the on-premises and VPC private deployments too. Tabnine also states it uses no third-party APIs or models, so nothing is forwarded onward.
- Retention Exceptions
- The one thing that does leave a non-air-gapped private installation is operational telemetry: the cluster streams GPU/CPU utilisation, throughput and latency to Tabnine's servers, and the client sends plugin configuration, machine details and one-way-hashed user email, hostname and IP. Metrics and logs are retained for a week. A fully air-gapped installation removes even that.
- Subprocessors
- Amazon Web Services — US East (N. Virginia), Google Cloud Platform — Council Bluffs, Iowa, Heroku — Virginia
- Subprocessor Count
- 3
- Transfer Mechanism
- none-stated
- Eu Procurement Ready
- conditional
- Eu Procurement Reason
- Architecturally this is one of the few assistants that can be bought with no external inference dependency at all: Tabnine trains its own models on permissively licensed open-source code, states it uses no third-party APIs or models, and ships on-premises, VPC and fully air-gapped installations. The no-train-no-retain policy is stated plainly and is said to hold for private deployments. The gap is entirely in the paperwork. The privacy policy names no Chapter V transfer mechanism — it promises "appropriate and suitable safeguards ... including contracts" and nothing more — and no DPA was reachable from any published path, which is a strange omission for a vendor selling to regulated enterprises. The compliance claim is "SOC2 compliant" with no type and no reachable trust centre, so it scores nothing here; a buyer with a browser should ask for the report directly. Note also that a non-air-gapped private installation still streams operational telemetry, including hashed user identifiers, to Tabnine infrastructure in the United States.
- Training Claim Basis
- stated
- Training Confidence
- high
- Residency Claim Basis
- stated
- Residency Confidence
- high
- Retention Claim Basis
- stated
- Retention Confidence
- high
- Subprocessors Claim Basis
- stated
- Subprocessors Confidence
- medium
- Residency Class
- customer-controlled
- Portability / Exit Path
- proprietary-only
- Subprocessor Jurisdiction
- non-eu
- Underlying model providers
- Tabnine (own models, trained only on permissively licensed open-source code)
