Coding Assistants
GitHub Copilot
High riskAI pair programmer integrated into editors and the GitHub platform, offering code completion, chat, and agentic coding workflows.
Is GitHub Copilot safe for confidential data?
Copilot sends code context from the developer's editor to the service to generate suggestions. On Business and Enterprise plans, prompts and suggestions are not retained for training and admins can enforce policies; on individual plans (Free, Pro, Pro+), GitHub may use interaction data for model training by default since April 2026 unless the user opts out. The practical exposure for most firms is source code and embedded secrets travelling through personal Copilot accounts on unmanaged machines.
Risk by plan
The same product often carries very different terms depending on the tier — consumer plans are where the exposure concentrates.
Training on interaction data by default since April 2026; per-user opt-out. No organizational policy layer.
No training on prompts/completions; org-wide policy controls, content exclusions.
Adds knowledge-base indexing of your repos (scoped to your org), audit log coverage, IP indemnity.
Data handling
Training on inputs
Business and Enterprise: prompts and completions are not used to train models. Individual (Free, Pro, Pro+): as of April 2026, GitHub may use Copilot interaction data — prompts, suggestions, and code snippets — to train models by default, with a per-user opt-out in settings.
Retention
Editor code completions are processed transiently on business tiers; chat and platform features may retain conversation history. Telemetry retention varies by plan and settings.
Residency
Processed in GitHub/Microsoft cloud infrastructure; no customer-selectable residency for the completion service.
Compliance
- SOC 2Yes
- GDPR / DPAYes
- HIPAA BAANo
Certifications typically apply to specific tiers and contracts — confirm scope in writing before relying on them.
New to these frameworks? See our plain-language guides to SOC 2 and the other AI compliance standards.
Enterprise controls
- Org-wide enable/disable and policy management
- Content exclusion paths (Business/Enterprise)
- Duplication-detection filter for public-code matches
- Audit logging (Enterprise)
- Microsoft DPA coverage
Frequently asked questions
Does GitHub Copilot train on my code?
Not on Business or Enterprise plans — prompts and suggestions are excluded from model training. On individual plans (Free, Pro, Pro+), GitHub may use interaction data, including prompts and code snippets, for model training by default since April 2026 unless the user opts out in their Copilot settings.
Can Copilot leak secrets or proprietary code?
Code context, which can include hardcoded credentials and proprietary logic, is sent to the service to generate completions. Content-exclusion rules help on managed plans, but they don't cover personal accounts on unmanaged machines — and they don't strip secrets already in the file being edited.
How should an engineering org govern Copilot?
Standardize on Business/Enterprise seats, exclude sensitive paths, and add prompt-level scanning for the tools Copilot doesn't cover — employees also paste code into ChatGPT and Claude. Sanitized AI catches source code and credentials across all of them, not just the sanctioned one.
Policy changelog
- Initial entry published from GitHub's published policies.
Sources
This profile summarizes the vendor's published policies as of the verification date. It is not legal advice.
GitHub Copilot is probably already in your organization.
Sanitized AI shows you who is using it and redacts sensitive data from prompts before it leaves your control.
More AI tool profiles
AWS's AI coding assistant and agent for IDEs, the CLI, and the AWS console, with completions, chat, and code transformation tied into AWS accounts.
Browser-based AI app builder from StackBlitz that generates, runs, and deploys full-stack JavaScript applications from prompts, popular with founders and rapid prototypers.
AI-first code editor that sends repository context to hosted models for completions, chat, and multi-file agentic edits.
Autonomous AI software engineer that plans and executes multi-step development work with its own shell, browser, and repository access, sold to teams and enterprises.