GitHub Copilot
AI status: AI features
Do GitHub Copilot's terms allow AI training on customer data? ?Some vendors use customer content to train their AI models. Teams check this to see whether what they upload could become training data.
Yes for individual accounts unless you opt out; not used for Copilot Business and Enterprise (GitHub Customer Agreement)
“collect and use your Inputs and Outputs to develop, train and improve artificial intelligence and machine learning models and technologies including those that power AI Features, unless (a) you opt out through your account settings, or (b) your use of the Service is governed by a GitHub Customer Agreement or volume licensing agreement.”
“GitHub does not use Copilot Business or Copilot Enterprise customer data to train AI models.”
“GitHub will not use Inputs or Outputs to train generative AI models, unless you have given us documented instructions to do so.”
Do GitHub Copilot's terms allow customer content to be used to improve its products? ?"Improve our services" language can allow content to be used beyond delivering the service, without mentioning AI training. We list it separately so it is not missed.
Under review
How do GitHub Copilot's terms say customers are told about changes to the terms? ?Some terms change as soon as they are posted; others require notice first. Teams want to know how they would learn about a change.
Not statedWhat control do customers have over AI training on their data at GitHub Copilot? ?Where training is allowed, vendors sometimes offer a way to opt out or require consent. This shows where that control lives, such as a setting, an email request, or a contract.
Enter your email to see moreDo GitHub Copilot's terms allow AI training on de-identified or aggregated data? ?Some terms allow training on data that has had identifiers removed or has been combined with other customers' data. The rules for that data are often different from the rules for raw content.
Enter your email to see moreDo GitHub Copilot's terms allow people to review customer content? ?Vendor staff or contractors sometimes read customer content for support, safety, or quality. Teams check this when the content is sensitive or confidential.
Enter your email to see moreHow long do GitHub Copilot's terms say it keeps customer content? ?How long a vendor keeps content, and what happens after deletion or termination, affects exit plans and deletion requests.
Enter your email to see moreHow long do GitHub Copilot's terms say it keeps AI inputs and outputs? ?AI features often keep prompts and outputs for a separate period, sometimes with a third-party model provider. Teams check this separately from general retention.
Enter your email to see moreDoes GitHub Copilot offer a zero-retention option for AI features? ?Some AI vendors offer a mode where prompts and outputs are not stored after the response. Teams look for it when handling sensitive data.
Enter your email to see moreWhich subprocessors does GitHub Copilot list? ?Subprocessors are the third parties that handle customer data on the vendor's behalf. Security and privacy teams use the list to see who else touches their data, and where.
Enter your email to see moreHow do GitHub Copilot's terms say customers are told about subprocessor changes? ?Vendors often promise advance notice before adding a subprocessor, and sometimes a right to object. This shows how, and how soon, customers are told.
Enter your email to see moreWhere do GitHub Copilot's documents say customer data is hosted? ?Where data is stored can matter for residency requirements and cross-border transfer rules.
Enter your email to see moreDoes GitHub Copilot offer a data processing agreement (DPA)? ?A data processing agreement is the contract many privacy laws expect when a vendor handles personal data. This shows whether one is public, available on request, or incorporated by reference.
Enter your email to see moreWhich security certifications does GitHub Copilot claim? ?Vendors often cite security certifications such as SOC 2 or ISO 27001. We list what they claim, not whether the claim has been verified.
Enter your email to see moreDo GitHub Copilot's terms say you own your inputs and outputs? ?Inputs are what you type in or upload. Outputs are what the platform responds with. People care because ownership decides who may reuse, sell or restrict that content, and terms often treat inputs and outputs differently or say nothing about outputs.
Enter your email to see moreHow we read documents ?We review the vendor's own public documents, like their terms of service, privacy policy, data processing agreement, and trust pages. Some answers come from a vendor's help or website pages, which are not contract terms, so each source is labelled with the kind of document it is. Every answer below carries a short quote or excerpt, a link to the source, and the date we captured it.
Found an issue? Let us know here.