GitHub Copilot Business — privacy & data policy

Provider: GitHub/Microsoft. PromptPrivacy score: 37/100. Last verified November 01, 2026.

What happens to your data?

GitHub collects account information, telemetry, and user content including code, inputs, and AI outputs when you use the service. This data is used to operate the service, troubleshoot issues, maintain security, and train and improve machine learning and artificial intelligence models across GitHub and Microsoft. Data is kept while your account is active and shared with corporate affiliates, subprocessors, and service providers.

Does it train on your data?

Trains on your content by default. GitHub states that it uses personal data—including code, inputs, AI outputs, and user files—to develop and improve products and technologies, explicitly including training artificial intelligence and machine learning models, and may share this data with affiliates such as Microsoft for the same purpose.

Can you opt out?

Not specified. While the statement notes that personal data is used to develop and train artificial intelligence and machine learning models, it does not detail any opt-out mechanism for AI training.

Data retention

GitHub retains personal data for as long as an account remains active and as necessary to fulfill contractual commitments, comply with legal obligations, resolve disputes, and enforce agreements. Specific retention schedules for Copilot prompts, code, or completions are not specified.

Encryption & security

GitHub states that it employs appropriate administrative, technical, and physical security controls to safeguard personal data. Specific encryption standards, such as TLS in transit or AES-256 at rest, as well as formal security certifications like SOC 2 or ISO 27001, are not specified in the text.

Is it safe for work?

Caution is advised based solely on this General Privacy Statement. Although organization-provided accounts benefit from a Data Protection Agreement where GitHub acts as a data processor, the policy also indicates that personal data and code inputs may be used to develop and train AI technologies without a documented training opt-out. Organizations should review their specific enterprise agreement and Copilot Business addendum before processing sensitive code.

Source policy: https://docs.github.com/site-policy/privacy-policies/github-privacy-statement