›_ Codex Issues
Codex Issues / #429

Add section on data privacy/security

Resolved 💬 11 comments Opened Apr 20, 2025 by schollii Closed Jan 14, 2026
💡 Likely answer: A maintainer (etraut-openai, contributor) responded on this thread — see the highlighted reply below.

What is the type of issue?

_No response_

What is the issue?

It would be much appreciated if you could add a section on data privacy. It is not clear to me how this tool works: I presume it has to send the local folder tree contents to openai? Looks like it does not use my chatGPT Plus subscription? Can local data be used to train your model? What if this folder has financial or business strategic data, need assurances I can safely use this tool, or at least what the boundaries are. A section that discusses this would be really useful.

Where did you find it?

_No response_

View original on GitHub ↗

11 Comments

pdemro · 1 year ago

Bumping this. Would like to see a privacy statement on Codex.

pietrini · 11 months ago

As a TSP, my company is very cautious with new tools. It would be great to have a proper privacy policy regarding Codex CLI software. We are looking forward to a tool for agentic coding, and we found that information for Claude Code.
I guess a lot is dependent on the model provider, but what about telemetry or crash reporting?

pdemro · 10 months ago

@pietrini I agree. We need some verbiage stating intent for Codex so the tool can be used in any setting concerned with privacy.

mkaalto · 8 months ago

This would be excellent. For example:

  • if a custom endpoint (Azure) is used, does codex call any other service?
  • if it calls, what data is sent (telemetry, prompts, responses, metadata like token counts or approvals/rejections)?
  • is there a way to opt out of extra data collection, if something is collected
tjcrowder · 7 months ago

FWIW, I found these helpful at a high level:

It would still be useful to have clear, detailed information in line with (for instance) the questions raised by @mkaalto.

mkaalto · 7 months ago

I did a bit of analysis (with codex) about this codebase at current latest main branch (commit cbd7d0d54330443887852b21636c816f60f1bde8).

Overall, the @tjcrowder links seem to apply in normal usage. If using custom endpoints, then there are still 1) update checks directly from Github API and 2) feedback, which sends the full conversation log (?) to OpenAI. But this must be explicitly requested and approved by user.

For maximum privacy:

  • set check_for_update_on_startup to false in config
  • use custom endpoint
  • do not configure otel exporter to config
  • never send feedback in the system
  • do not configure MCP servers

Below is the LLM output for data connections it found from codebase & relevant files:

LLM calls

<details>

Normal (openai) endpoint

Built-in providers (e.g., OpenAI) are used by default and connect to https://api.openai.com/v1 (or the configured base URL). Auth is via Authorization: Bearer ... and optional ChatGPT-Account-ID headers.

Login is user-initiated (not on by default) via codex login. The local login server opens a browser to the issuer’s authorization URL and exchanges the returned code at the issuer’s /oauth/token. Optionally, a device-code flow polls issuer endpoints. Connects to the configured issuer (defaults to OpenAI auth).

Custom endpoint for LLM

Custom provider endpoints (e.g., Azure) are used when configured in config.toml. Not on by default. Connections go to your specified base_url (e.g., https://<project>.openai.azure.com/openai/...) with optional api-version query params.

</details>

Other data

<details>

Telemetry (opt-in?)

Telemetry is opt-in (disabled by default) via [otel] in config.toml. It exports OpenTelemetry log events to the user-configured OTLP endpoint (HTTP /v1/logs or gRPC :4317), not to Azure/OpenAI.

Feedback

Feedback upload to Sentry is manual (not on by default) when the user chooses to send logs. Connects to Sentry ingestion per the embedded DSN.

User flow: the TUI explicitly asks for consent (“Upload logs?” Yes/No) before opening the note composer, and only submits on user action. Upload is triggered on submit; accidental upload is prevented by the explicit consent and submit steps.

Update checks

Update checks are enabled only in release builds and when check_for_update_on_startup is true. They fetch from GitHub API and/or Homebrew cask to discover the latest version.

Proxy

The local Responses API proxy listens on 127.0.0.1 and forwards only POST /v1/responses to the configured upstream. Default upstream is OpenAI; can be pointed at Azure with explicit URL. Not used by default.

</details>

Example feedback content (rolout-file):

<details>

{
    "timestamp": "2025-11-27T12:09:39.553Z",
    "type": "session_meta",
    "payload": {
        "id": "019ac538-19c8-7772-b5eb-44bc77fd0ee3",
        "timestamp": "2025-11-27T12:09:39.528Z",
        "cwd": "/tmp/codex",
        "originator": "codex_cli_rs",
        "cli_version": "0.58.0",
        "instructions": "[contents of AGENTS.md]",
        "source": "cli",
        "model_provider": "azure",
        "git": {
            "commit_hash": "cbd7d0d54330443887852b21636c816f60f1bde8",
            "branch": "main",
            "repository_url": "https://github.com/openai/codex"
        }
    }
}
{
    "timestamp": "2025-11-27T12:09:39.606Z",
    "type": "response_item",
    "payload": {
        "type": "message",
        "role": "user",
        "content": [
            {
                "type": "input_text",
                "text": "[contents of AGENTS.md]",
            }
        ]
     }
}
{
    "timestamp": "2025-11-27T12:09:39.607Z",
    "type": "response_item",
    "payload": {
        "type": "message",
        "role": "user",
        "content": [
            {
                "type": "input_text",
                "text": "<environment_context>\n  <cwd>/tmp/codex</cwd>\n  <approval_policy>on-request</approval_policy>\n  <sandbox_mode>read-only</sandbox_mode>\n  <network_access>restricted</network_access>\n  <shell>bash</shell>\n</environment_context>"
            }
        ]
    }
}

</details>

AndrewSpittlemeister · 7 months ago

@mkaalto thanks for doing that legwork.

Is it worth opening an issue to request the feature we are implying we want? Having a configuration option where using locally hosted models with OpenAI API compatibility completely cut out data being sent elsewhere would likely lead to a lot more users (including myself).

pdemro · 7 months ago

I think you have a good idea for a feature @AndrewSpittlemeister .

For me, what's also important is to spell out what data the Codex source code is collecting, and how it's being used. For example, if I'm using Gemini for the backend model for Codex, I need to understand how both Google Gemini _and_ Codex are collecting & using my data. Bonus for both of us if the privacy policy is released and OpenAI commits to collecting no or minimal data from Codex. At the very least I would expect something to say that OpenAI won't harvest your source code or use it for training when using Codex.

codeRattlesnake · 6 months ago

Bump

etraut-openai contributor · 6 months ago

This is quite an old thread at this point, and the above posts have covered many different topic areas.

In addition to the answers already posted above, you may find that some of your questions are answered in our documentation here and here.

For more detailed questions (e.g. about specific endpoint usage or other implementation details), I recommend cloning the OSS repo and asking Codex questions about its own code.

AndrewSpittlemeister · 5 months ago

@etraut-openai

This is exactly what I think we were looking for, thank you for giving us some direct links.

Tagging some others of interest from this thread to push notifications.

@codeRattlesnake @pdemro @mkaalto @tjcrowder @pietrini