service github-copilotvendor GitHub (Microsoft)category Coding tools
Depends (Caution)Free, Pro and Pro+: used for training unless you opt out at github.com/settings/copilot/features (change effective 'April 24'). Business and Enterprise: never.
Free, Pro and Pro+: used for training unless you opt out at github.com/settings/copilot/features (change effective 'April 24'). Business and Enterprise: never.
GitHub may also use interactions from users with a Copilot Free, Copilot Pro, and Copilot Pro+ subscription - including inputs, outputs, code snippets, and associated context - to train and improve our AI models unless they have opted out.
Business/Enterprise: IDE chat and completions are not retained. Chat on github.com, mobile and CLI keeps prompts 28 days. Engagement data: 2 years.
Prompts and Suggestions: Retained for 28 days.
Against the 21 tools that state a period (grey dots):
No named ZDR program. For Business/Enterprise, IDE prompts and suggestions are not retained by default.
Prompts and Suggestions: Not retained
Copilot runs real-time content filters on all prompts and outputs. GitHub has ZDR agreements with OpenAI, Anthropic (GA features) and xAI, and Google does not log prompts for abuse monitoring. Exception: Anthropic retains prompts and outputs for Claude Fable 5 / 5.1 to run safety classifiers; a ZDR exemption is available to eligible customers until the end of 2026.
When Claude Fable 5 or Claude Fable 5.1 is used, Anthropic retains data, including prompts and outputs, by default to operate safety classifiers that detect harmful use.
Via GitHub Enterprise Cloud with data residency. No Singapore region listed. Some Copilot features unavailable on GHE.com.
The available regions are:
Copilot Business and Enterprise are covered by GitHub's SOC 2 Type II report and its ISO 27001 scope.
include GitHub Enterprise Cloud for github.com with all new regions like the EU, as well as Copilot Business and Enterprise.
No BAA for Copilot was found. Copilot falls under the GitHub Data Protection Agreement (October 2025), which says customers must not give GitHub HIPAA protected health information without GitHub's prior, written and specific consent.
Except with GitHub’s prior, written, and specific consent, You shall not provide GitHub any Personal Data: … constituting protected health information
Copilot itself runs on GitHub.com / GHE.com. A technical-preview mode lets Copilot CLI work with GitHub Enterprise Server in air-gapped setups using an admin-configured model provider.
you can configure Copilot CLI to work with GitHub Enterprise Server in disconnected or air-gapped environments, without connecting to GitHub's cloud platforms or requiring a Copilot license.
Spotted something wrong or out of date? Corrections are welcome; see how to send one. How statuses are assigned.