Renuka,
This is a very profound questions and should be available https://www.ibm.com/us-en/privacy
But to answer from IBM Bob Docs:
1. Is customer source code used to train IBM foundation models or other Bob models?
What the documentation says: No evidence of training on customer code.
The documentation makes two explicit statements relevant to this:
- Telemetry (IDE): "IBM Bob does not collect your code, prompts, or other sensitive information as part of telemetry data." — [
telemetry-data_internal.md › Overview]
Bob Shell: "No personal information, prompt content, or file content is collected." — [configuring_internal.md › Usage statistics]
2. Are prompts, code snippets, repository content, or generated outputs retained beyond operational processing?
What the documentation says: Not explicitly addressed.
The documentation confirms what is not collected via telemetry (usage analytics), but it does not specify:
- Whether prompt/response pairs sent to the LLM backend are logged server-side
- Whether conversation history is stored and for how long
- Whether any retention period applies to inference payloads
Data types explicitly flagged as prohibited for use with Bob (regardless of plan):
- Sensitive Personal Information (SPI)
- Personal Health Information (PHI)
- Export-controlled code marked Red or Gray
- Non-IBM IP
- Sensitive Financial Data (banking numbers, PANs, credit card numbers)
Material Non-Public Information (MNPI)
3. Encryption in transit and at rest — Trial environment specifically
What the documentation says: IBM Bob's own security rules mandate TLS 1.2+ and AES-256, but these are stated as coding standards for IBM developers building with Bob, not as a certified statement about Bob's own SaaS infrastructure.
Specifically, the security-hardening_internal.md document (which is a security guidance rule for IBMers using Bob) states:
- "MUST use TLS 1.2 or higher for data in transit. TLS 1.3 is preferred"
- "MUST encrypt sensitive data at rest (AES-256 or equivalent)"
These are Bob's internal security coding rules, not a published SaaS data sheet for the Bob platform itself.
What is not available in the documentation:
- No published encryption specification for the Bob SaaS backend infrastructure specifically for trial users
- No differentiation between trial and paid/enterprise encryption posture
No SOC 2, ISO 27001, or FedRAMP certification status is referenced
4. MCP Servers — An Additional Risk to Be Aware Of
If you are using any external MCP servers (e.g., third-party tools configured in Bob), the documentation explicitly warns:
"External MCP servers may send your data to external providers or third-party services, could expose sensitive code, credentials, or proprietary information, and may store or log data in ways you don't control."
Recommendation from IBM Bob's own docs: Avoid using external MCP servers with sensitive or proprietary code; prefer local MCP servers for confidential projects.