GitHub Copilot

GitHub's general privacy statement reserves use of personal data to develop and improve its products and technologies, including training models, with aggregation and de-identification where feasible. The statement is organisation-wide and not scoped to Copilot.

Requires written confirmation — see Before you sign ↓

Not found in the public sources scanned — ask the vendor directly.

Requires written confirmation — see Before you sign ↓

GitHub publishes a subprocessor list governed by the GitHub Data Protection Agreement and publishes new subprocessors in advance.

Requires written confirmation — see Before you sign ↓

GitHub states Copilot can enforce geographic data residency for GitHub Enterprise Cloud customers with such requirements.

Not found in the public sources scanned — ask the vendor directly.

Confirm in writing: Ask the vendor to state this in writing before signing.

GitHub runs a dedicated Copilot trust portal, which returned no readable content to this collection across repeated attempts. What remains is the GitHub-wide privacy statement and subprocessor list, neither scoped to Copilot.

Copilot's specific commitments — whether prompts and suggestions train models, how that differs between individual and Business or Enterprise plans, and retention — live in the portal that could not be read. This assessment is incomplete on those points; that is a statement about our collection, not about GitHub's posture.

Question for vendor: Please provide the GitHub Copilot Trust Center documentation covering prompt and suggestion retention, human review, and whether Business and Enterprise content is excluded from model training.

GitHub's general privacy statement reserves use of personal data for developing and improving products including training models. It governs GitHub as a whole and names Copilot only as one feature among several.

This clause can neither clear nor condemn Copilot. GitHub's published Copilot-specific position has historically been more restrictive than its general statement, so reading the general clause as Copilot policy would misrepresent it in both directions.

Question for vendor: Does the general privacy statement's training reservation apply to Copilot prompts and suggestions, and does the answer differ by plan?

Copilot can enforce geographic data residency for GitHub Enterprise Cloud customers.

Residency control is a real capability for regulated buyers, but it is a procurement decision rather than a setting every Copilot customer can reach.

Question for vendor: Which regions are supported, and does residency cover prompts and suggestions as well as repository content?

Several candidate sources on this domain are GitHub user profile pages reached at paths like /ai, /dpa and /aup, which are usernames on github.com rather than policy pages. They carry no assurance content.

Recorded so a reader can see why this assessment is thinner than others: the collection under-represents what GitHub publishes about Copilot, and the scan is worth re-running once the trust portal is retrievable.

Technical evidence (DNS, certificate, or HTTP) shows a dependency on Microsoft Azure as a platform provider. This dependency is not identified in the vendor's published materials.

An undisclosed provider dependency is exactly the gap independent verification exists to surface.

Question for vendor: Verification required — Microsoft Azure appears to be involved as a platform provider: confirm whether this dependency exists, and whether it processes customer data.

Technical evidence (DNS, certificate, or HTTP) shows a dependency on AWS as a platform provider. This dependency is not identified in the vendor's published materials.

An undisclosed provider dependency is exactly the gap independent verification exists to surface.

Question for vendor: Verification required — AWS appears to be involved as a platform provider: confirm whether this dependency exists, and whether it processes customer data.

Technical evidence (DNS, certificate, or HTTP) shows a dependency on Google as a service provider. This dependency is not identified in the vendor's published materials.

An undisclosed provider dependency is exactly the gap independent verification exists to surface.

Question for vendor: Verification required — Google appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data.

Technical evidence (DNS, certificate, or HTTP) shows a dependency on Stripe as a service provider. This dependency is not identified in the vendor's published materials.

An undisclosed provider dependency is exactly the gap independent verification exists to surface.

Question for vendor: Verification required — Stripe appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data.

Technical evidence (DNS, certificate, or HTTP) shows a dependency on Microsoft as a service provider. This dependency is not identified in the vendor's published materials.

An undisclosed provider dependency is exactly the gap independent verification exists to surface.

Question for vendor: Verification required — Microsoft appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data.

Technical evidence (DNS, certificate, or HTTP) shows a dependency on Atlassian as a service provider. This dependency is not identified in the vendor's published materials.

An undisclosed provider dependency is exactly the gap independent verification exists to surface.

Question for vendor: Verification required — Atlassian appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data.