AI Code Completion Service  ·  View 10 of 21  ·  Data

Data Flow — What Leaves the Machine

Seven stages, ending in three categories: kept without code, kept with code by opt-in, and never kept.

Editable source SVG draw.io All views
On the machine Open buffers never uploaded whole Source selection Redaction secrets, ignores In flight FIM prompt ≤ 8 k tokens Request envelope tenant, seat, deadline Held in memory only Assembled context KV prefix state recomputable Generated tokens Split at the boundary Stream split code vs not Persisted — no code Interaction events ids, latency, verdicts Quality aggregates ADX, 400 days Usage & cost per tenant Persisted — may hold code Diagnostic sample opt-in, ≤ 24 h Eval corpus licensed only Never persisted Zero-retention tenants no path exists Training no data path redacted span prefix suggestion metadata opt-in only Data Flow — What Leaves the Machine and What Comes Back Data store Application we own Security / platform Decision point Queue / topic Risk / gap synchronous event / async failure / alternate The red path is the only way code-bearing data is retained, and it is refused by default. Zero-retention tenants have no arrow because they have no path. v 1.0 · owner Developer Experience Architecture · date 2026-10

Decisions

  • The stream split at the boundary is the enforcement point for retention mode: it separates interaction metadata from anything that could contain code before either is written.
  • Diagnostic retention is opt-in, short (≤ 24 h) and drawn in red, because it is the only path by which a tenant's code reaches durable storage.
  • Evaluation corpora are built from licensed material only — never from tenant traffic, however anonymised.

Assumptions

  • Prompt budget ≤ 8,000 tokens; non-code interaction telemetry retained 30 days raw and 400 days aggregated.
  • Code-bearing telemetry: zero in zero-retention mode, which is the enterprise default.

Risks

  • Crash dumps, traces and request logs are the classic leak in a design like this: they are produced by infrastructure that does not know about retention mode, so the scrub has to be enforced at the sink as well as the source.
◀  Integration Surface All views Data Architecture — Ownership and Rebuildability  ▶
Solution Architecture v1.0 · Microsoft Azure · Developer Experience Architecture · 2026-10 · 21 views · 15 architecture decision records10-request-path-data-flow