IBM Project Bob

 View Only

 IBM Bob Trial — Questions on Source Code Training, Retention, and Encryption

Renuka Kulkarni's profile image
Renuka Kulkarni posted 08/13/26 10:38 AM

I am currently evaluating the IBM Bob trial version and would like to confirm the data-handling policies that apply specifically to trial users.

  1. Is customer source code submitted through IBM Bob used to train IBM foundation models or any other models used by Bob?

  2. Are prompts, code snippets, repository content, or generated content retained beyond operational processing? If yes, what is the retention period?

  3. What data retention and encryption policies apply specifically to the IBM Bob trial environment, including encryption in transit and at rest?

If possible, please also share the official IBM documentation or terms that cover these points for the trial version.

Thank you.

Narendra Murthy's profile image
Narendra Murthy

Renuka,

This is a very profound questions and should be available https://www.ibm.com/us-en/privacy

But to answer from IBM Bob Docs:

1. Is customer source code used to train IBM foundation models or other Bob models?

What the documentation says: No evidence of training on customer code.

The documentation makes two explicit statements relevant to this:

  • Telemetry (IDE): "IBM Bob does not collect your code, prompts, or other sensitive information as part of telemetry data." — [telemetry-data_internal.md › Overview]

Bob Shell: "No personal information, prompt content, or file content is collected." — [configuring_internal.md › Usage statistics]


2. Are prompts, code snippets, repository content, or generated outputs retained beyond operational processing?

What the documentation says: Not explicitly addressed.

The documentation confirms what is not collected via telemetry (usage analytics), but it does not specify:

  • Whether prompt/response pairs sent to the LLM backend are logged server-side
  • Whether conversation history is stored and for how long
  • Whether any retention period applies to inference payloads

Data types explicitly flagged as prohibited for use with Bob (regardless of plan):

  • Sensitive Personal Information (SPI)
  • Personal Health Information (PHI)
  • Export-controlled code marked Red or Gray
  • Non-IBM IP
  • Sensitive Financial Data (banking numbers, PANs, credit card numbers)

Material Non-Public Information (MNPI)


3. Encryption in transit and at rest — Trial environment specifically

What the documentation says: IBM Bob's own security rules mandate TLS 1.2+ and AES-256, but these are stated as coding standards for IBM developers building with Bob, not as a certified statement about Bob's own SaaS infrastructure.

Specifically, the security-hardening_internal.md document (which is a security guidance rule for IBMers using Bob) states:

  • "MUST use TLS 1.2 or higher for data in transit. TLS 1.3 is preferred"
  • "MUST encrypt sensitive data at rest (AES-256 or equivalent)"

These are Bob's internal security coding rules, not a published SaaS data sheet for the Bob platform itself.

What is not available in the documentation:

  • No published encryption specification for the Bob SaaS backend infrastructure specifically for trial users
  • No differentiation between trial and paid/enterprise encryption posture

No SOC 2, ISO 27001, or FedRAMP certification status is referenced


4. MCP Servers — An Additional Risk to Be Aware Of

If you are using any external MCP servers (e.g., third-party tools configured in Bob), the documentation explicitly warns:

"External MCP servers may send your data to external providers or third-party services, could expose sensitive code, credentials, or proprietary information, and may store or log data in ways you don't control."

Recommendation from IBM Bob's own docs: Avoid using external MCP servers with sensitive or proprietary code; prefer local MCP servers for confidential projects.



Erwin Friethoff's profile image
Erwin Friethoff

See the official statements here: https://www.ibm.com/software/reports/compatibility/clarity-reports/report/html/softwareReqsForProduct?deliverableId=C022F0E03C224A2BB3D035EF6892AAAB&osPlatforms=spcrAllValues&duComponentIds=spcrAllValues&mandatoryCapIds=spcrAllValues&optionalCapIds=spcrAllValues
 
Duration of Processing

• The duration of Processing Content within this Cloud Service corresponds to the duration of the Cloud Service.


Data Security

• Content is encrypted when transmitted by IBM on any public networks.

• Content is encrypted when transmitted by IBM within the Cloud Service's private datacenter network.

Certifications

This Cloud Service maintains the following industry recognized compliance, certifications, attestations, or reports as one measure of this Cloud Service's implementation of the TOMs:

  • • ISO 27001
  • • ISO 27017
  • • ISO 27018
  • • ISO 27701


From the IBM Terms: https://www.ibm.com/support/customer/csol/terms/?ref=i127-9285-10-07-2026-zz-en
- Chapter 5.3.3 IBM will not use the ClientContent or model Outputs to train any foundation models or embedding models.

Hope this helps.
@Narenda Murty If you ping me on Slack, I will get you some links where you can find the details, the site you linked is not the correct and this information is available.