GitHub Copilot vs. Replit: data protection per plan
GitHub Copilot (7 plans) and Replit (4 plans) side by side: DPA, training on inputs, hosting and data retention per plan, based on the providers’ public documents. Without rating.
Last updated: (latest review date of the tools shown)
At a glance
Each value is listed with the plans it applies to. Pick a tier to see only plans of that tier; if plans are chosen in the plan comparison below, the table shows exactly those.
All plans: each value is listed with the plans it applies to.
| Feature | GitHub Copilot | Replit |
|---|---|---|
| Provider based in | According to the GitHub General Privacy Statement | Replit, Inc., 1001 E Hillsdale Blvd, Suite 400, Foster City, CA 94404, USA |
| Plans recorded | 7 | 4 |
| Hosting | mixed: Free, Student, Pro, Pro+, MaxEU option: Business, Enterprise | US only: Startermixed: Core, Pro, Enterprise |
| Training on inputs | opt-out available: Free, Pro, Pro+, Maxnot documented: Studentno: Business, Enterprise | not documented: Starter, Coreopt-out available: Prono: Enterprise |
| DPA | not documented: Free, Student, Pro, Pro+, Maxyes: Business, Enterprise | not documented: Starter, Coreyes: Pro, Enterprise |
| As of | 18 Oct 2026 | 18 Oct 2026 |
Plans compared
Comparing: GitHub Copilot Business vs. Replit Pro
| Feature | GitHub CopilotBusiness | ReplitPro |
|---|---|---|
| yes | yes | |
| Details: DPA available | yes: Copilot is covered by the GitHub Data Protection Agreement, which applies to all generally available (GA) Copilot features and the previews listed in 'GitHub DPA-Covered Previews' (q8); GitHub and customers 'can enter a Data Protection Agreement that supports compliance with the GDPR' (q1). For purchases directly from GitHub, the GitHub Generative AI Services Terms apply; for purchases via Microsoft, the Microsoft Product Terms apply (q8). Provider’s DPA | yes (DPA forms part of the Replit Commercial Agreement; EU SCCs Module Two/Three, UK Addendum; general authorisation for sub-processors) Provider’s DPA |
| differs by plan | no | opt-out available |
| Details: Training on inputs | "No. GitHub does not use either Copilot Business or Enterprise data to train its models." (q1); q3: "GitHub does not use Copilot Business or Copilot Enterprise customer data to train AI models." Third-party models: according to q3, OpenAI, among others, "do not train models on customer business data", Google/Gemini does not use prompts for training, zero data retention agreements with OpenAI, Anthropic, xAI and Fireworks AI (details per provider in q3). q14: "Copilot Business and Copilot Enterprise customers' data is protected under GitHub's Data Protection Agreement, which prohibits such use without customer authorization." | Privacy Policy (as of 2026-08-03): legitimate interest in using personal data 'to improve the accuracy of our machine learning technologies such as code generation'. Terms: Replit may view the content of private apps, including to improve the service. Documentation 'Model improvement' (q7): opt-out from the use of content for model development only for Pro users (Settings > Personalization > Model Improvement); for Enterprise, Replit does not use customer content for training. Default setting not documented. According to the documentation, the opt-out applies only to new content and does not delete any data; processing for operation, security and troubleshooting continues. |
| differs by plan | EU option | mixed |
| Details: Data residency | Default on github.com: storage in the USA (q7). EU data residency via GitHub Enterprise Cloud with GHE.com: Copilot Business or Enterprise can be assigned there (q7). With the policy 'Restrict Copilot to data residency compliant models', according to q6, 'all inference processing and associated data' remain in the selected region (EU or USA); policy disabled by default, additional consumption +10 % AI Credits (q6). Without this policy, according to q5, Copilot data and logs are 'by default stored outside your region'. Inline suggestions: models hosted on Azure (q3). | Trust Center (FAQ): production infrastructure 'runs entirely on Google Cloud Platform (GCP), in the United States'; 'Data residency can be configured per customer needs'. Security page: a separate, isolated GCP project per customer. Privacy Policy: services hosted primarily in the USA. Docs 'Geography': workspace region (North America, EU, Asia) selectable only on Pro; publishing region (North America, EU, Asia, South America, Australia) on Core, Pro and Enterprise; free accounts publish to North America by default; region cannot be changed after publishing. The page does not state where AI requests are processed; according to the list, the AI sub-processors are located in the USA. Pro: workspace and publishing region selectable (including EU). |
| list available | list available | |
| Details: List published |
|
|
| differs by plan | Default settings according to q1: access… | DPA: customer may request return or… |
| Details: Data retention | Default settings according to q1: access via IDE (chat and code completions): prompts and suggestions "Not retained"; User Engagement Data two years; Feedback Data "as long as needed for its intended purpose". All other access routes (including github.com, Mobile, CLI): prompts and suggestions 28 days; User Engagement Data two years. DPA (October 2025 version), Section 8: after the end of the services, GitHub deletes the Customer Personal Data or returns it at the customer's choice and deletes existing copies "in accordance with our retention and deletion policy" (q13). Unlike q1, the Copilot Trust Center FAQ (q16) assigns Copilot CLI to IDE access: inputs and outputs "Not retained by default" (exception: time-limited retention in the event of confirmed violations of the Acceptable Use Policies or Terms of Service); other access: "Retained for up to 28 days by default". | DPA: customer may request return or deletion of customer data up to 90 days after the end of the contract. Docs 'Deleting your data': account deletion removes all content, personal information is 'purged from our systems'; no time limits. Privacy Policy: deletion or de-identification once no longer needed in identifiable form; no specific time limits. Retention periods for project content and prompts during operation: not publicly documented. Docs 'Account Inactivity': paid subscriptions are not terminated for inactivity. Pricing page: database rollback up to 28 days. |
| differs by plan | 19 USD/user/mo | 100 USD/mo… (further prices in the details) |
| Details: Price | 19 USD per assigned seat/month (q2) | 100 USD per month or 90 USD per month with annual payment (pricing page; plus taxes depending on location). The pricing page shows further Pro tiers at 225, 440, 850 and 2,050 USD per month (with annual payment 215, 425, 825 and 2,000 USD per month); monthly credits according to the FAQ 'starting at $100 for Pro'. Additional usage under Effort-Based Pricing (pay-as-you-go) or via credit packs; budgets can be set as a hard cap. |
| yes | yes | |
| Details: AI features included | yes (1,900 AI Credits per user/month, access to premium models; q2) | yes (10 parallel Agents, USD 100 credit for the most powerful models, up to 15 collaborators, premium support) |
| 11 sources | 11 sources | |
| Details: Sources with retrieval date |
|
|
Contract / DPA
- GitHub Copilot Businessyes
- Replit Proyes
- GitHub Copilot Business
yes: Copilot is covered by the GitHub Data Protection Agreement, which applies to all generally available (GA) Copilot features and the previews listed in 'GitHub DPA-Covered Previews' (q8); GitHub and customers 'can enter a Data Protection Agreement that supports compliance with the GDPR' (q1). For purchases directly from GitHub, the GitHub Generative AI Services Terms apply; for purchases via Microsoft, the Microsoft Product Terms apply (q8).
Provider’s DPAReplit Proyes (DPA forms part of the Replit Commercial Agreement; EU SCCs Module Two/Three, UK Addendum; general authorisation for sub-processors)
Provider’s DPA
Training
- differs by plan
- GitHub Copilot Businessno
- Replit Proopt-out available
- GitHub Copilot Business
"No. GitHub does not use either Copilot Business or Enterprise data to train its models." (q1); q3: "GitHub does not use Copilot Business or Copilot Enterprise customer data to train AI models." Third-party models: according to q3, OpenAI, among others, "do not train models on customer business data", Google/Gemini does not use prompts for training, zero data retention agreements with OpenAI, Anthropic, xAI and Fireworks AI (details per provider in q3). q14: "Copilot Business and Copilot Enterprise customers' data is protected under GitHub's Data Protection Agreement, which prohibits such use without customer authorization."
Replit ProPrivacy Policy (as of 2026-08-03): legitimate interest in using personal data 'to improve the accuracy of our machine learning technologies such as code generation'. Terms: Replit may view the content of private apps, including to improve the service. Documentation 'Model improvement' (q7): opt-out from the use of content for model development only for Pro users (Settings > Personalization > Model Improvement); for Enterprise, Replit does not use customer content for training. Default setting not documented. According to the documentation, the opt-out applies only to new content and does not delete any data; processing for operation, security and troubleshooting continues.
Hosting
- differs by plan
- GitHub Copilot BusinessEU option
- Replit Promixed
- GitHub Copilot Business
Default on github.com: storage in the USA (q7). EU data residency via GitHub Enterprise Cloud with GHE.com: Copilot Business or Enterprise can be assigned there (q7). With the policy 'Restrict Copilot to data residency compliant models', according to q6, 'all inference processing and associated data' remain in the selected region (EU or USA); policy disabled by default, additional consumption +10 % AI Credits (q6). Without this policy, according to q5, Copilot data and logs are 'by default stored outside your region'. Inline suggestions: models hosted on Azure (q3).
Replit ProTrust Center (FAQ): production infrastructure 'runs entirely on Google Cloud Platform (GCP), in the United States'; 'Data residency can be configured per customer needs'. Security page: a separate, isolated GCP project per customer. Privacy Policy: services hosted primarily in the USA. Docs 'Geography': workspace region (North America, EU, Asia) selectable only on Pro; publishing region (North America, EU, Asia, South America, Australia) on Core, Pro and Enterprise; free accounts publish to North America by default; region cannot be changed after publishing. The page does not state where AI requests are processed; according to the list, the AI sub-processors are located in the USA. Pro: workspace and publishing region selectable (including EU).
Sub-processors
- GitHub Copilot Businesslist available
- Replit Prolist available
- GitHub Copilot Business
- Third-party providers as per the list (as retrieved 2026-10-07): Amazon Web Services Inc (AWS) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States United States; Anthropic PBC AI Inference and AI Services United States United States; Cerebras Systems Inc. AI Inference and AI Services United States United States; Cloudflare Content delivery service United States United States; DataDome Solutions, Inc. Security management United States, France United States; Elasticsearch, Inc. Cloud Hosted Infrastructure United States United States; Fastly Content delivery service United States United States; Fireworks AI AI Inference and AI Services United States, Germany, Iceland United States; FullStory, Inc. Customer support ticketing analysis United States United States; Google Cloud Platform (GCP) Cloud Hosted Infrastructure, AI Inference and AI Services United States, Belgium, Singapore United States; Hewlett-Packard Limited Cloud Hosted Infrastructure United States United States; LambdaTest Cloud Hosted Infrastructure United States United States; Microsoft (Azure) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States, Canada, Chile, Mexico United States; Microsoft (Azure) Cognitive Services and customer support ticketing analysis United States United States; Microsoft Technical Services United States, Australia, Brazil, Canada, France, Japan, Norway, Spain, Sweden, Switzerland, United Kingdom United States; Moveworks Customer support ticketing analysis United States United States; NexMo Inc (aka Vonage) SMS notification provider for 2 Factor Authentication United States United States; Obsidian Security Security management United States United States; OpenAI AI Inference and AI Services United States United States; Oracle America, Inc. Cloud Hosted Infrastructure United States United States; Pusher Building and managing real-time infrastructure for web and mobile applications United States United States; Tines Automation Inc. Security management United States United States; Twilio (SendGrid) SMS notification provider for 2 Factor Authentication United States United States; xAI AI Inference and AI Services United States United States; Zendesk Customer support ticketing system United States United States
- GitHub subsidiaries as per the list: GitHub Australia Pty Ltd, GitHub BV (NL), GitHub Canada ULC, GitHub Germany GmbH, GitHub India Pty Ltd, npm Inc, Semmle Inc
Replit Pro- Cloud/hosting: Google (cloud infrastructure and AI models), Microsoft Azure, Cloudflare, HashiCorp Cloud, Neon (database) – all USA
- AI models and infrastructure: Anthropic, OpenAI, OpenRouter, Baseten, Fireworks AI, Parallel Web Systems, Firecrawl, Anima App – all USA
- Others (extract): Stripe, Orb, Verifi, Clazar (payment/billing), Clerk, Stytch, WorkOS (identity/SSO), Datadog, Sentry, Grafana Labs (monitoring), Zendesk, Common Room, Civilized Discourse Construction Kit, IntouchCX (Canada), OWND ApS/Parahelp (support), analytics/marketing services (including Amplitude, Segment, HubSpot, ZoomInfo – USA)
- Full list (around 50 entries) see subprocessorUrl; all except IntouchCX (Canada) located in the USA
Retention
- differs by plan
- GitHub Copilot BusinessDefault settings according to q1: access…
- Replit ProDPA: customer may request return or…
- GitHub Copilot BusinessDefault settings according to q1: access via IDE (chat and code completions): prompts and suggestions "Not retained"; User Engagement Data two years; Feedback Data "as long as needed for its intended purpose". All other access routes (including github.com, Mobile, CLI): prompts and suggestions 28 days; User Engagement Data two years. DPA (October 2025 version), Section 8: after the end of the services, GitHub deletes the Customer Personal Data or returns it at the customer's choice and deletes existing copies "in accordance with our retention and deletion policy" (q13). Unlike q1, the Copilot Trust Center FAQ (q16) assigns Copilot CLI to IDE access: inputs and outputs "Not retained by default" (exception: time-limited retention in the event of confirmed violations of the Acceptable Use Policies or Terms of Service); other access: "Retained for up to 28 days by default".Replit ProDPA: customer may request return or deletion of customer data up to 90 days after the end of the contract. Docs 'Deleting your data': account deletion removes all content, personal information is 'purged from our systems'; no time limits. Privacy Policy: deletion or de-identification once no longer needed in identifiable form; no specific time limits. Retention periods for project content and prompts during operation: not publicly documented. Docs 'Account Inactivity': paid subscriptions are not terminated for inactivity. Pricing page: database rollback up to 28 days.
Price
- differs by plan
- GitHub Copilot Business19 USD/user/mo
- Replit Pro100 USD/mo… (further prices in the details)
- GitHub Copilot Business
19 USD per assigned seat/month (q2)
Replit Pro100 USD per month or 90 USD per month with annual payment (pricing page; plus taxes depending on location). The pricing page shows further Pro tiers at 225, 440, 850 and 2,050 USD per month (with annual payment 215, 425, 825 and 2,000 USD per month); monthly credits according to the FAQ 'starting at $100 for Pro'. Additional usage under Effort-Based Pricing (pay-as-you-go) or via credit packs; budgets can be set as a hard cap.
- GitHub Copilot Businessyes
- Replit Proyes
- GitHub Copilot Business
yes (1,900 AI Credits per user/month, access to premium models; q2)
Replit Proyes (10 parallel Agents, USD 100 credit for the most powerful models, up to 15 collaborators, premium support)
Evidence
- GitHub Copilot Business11 sources
- Replit Pro11 sources
- GitHub Copilot Business
- GitHub Copilot: Plans & pricing incl. FAQ (Privacy, Retention, Training)Pricing page / provider FAQ, retrieved 18 Oct 2026
- Plans for GitHub Copilot (GitHub Docs)Official documentation, retrieved 14 Oct 2026
- Hosting of models for GitHub Copilot (GitHub Docs)Official documentation, retrieved 18 Oct 2026
- GitHub SubprocessorsSub-processor list, retrieved 14 Oct 2026
- About storage of your data with data residency (GHE.com)Official documentation, retrieved 14 Oct 2026
- GitHub Copilot with data residencyOfficial documentation, retrieved 14 Oct 2026
- About GitHub Enterprise Cloud with data residencyOfficial documentation, retrieved 14 Oct 2026
- Resources for getting approval of GitHub CopilotOfficial documentation, retrieved 14 Oct 2026
- GitHub Data Protection Agreement (DPA), version October 2025DPA, retrieved 14 Oct 2026
- Managing GitHub Copilot policies as an individual subscriber (GitHub Docs)Documentation, retrieved 18 Oct 2026
- GitHub Copilot Trust Center: FAQ (Privacy, Security, Commercial)Trust Center / provider FAQ, retrieved 18 Oct 2026
Replit Pro- PricingPricing page, retrieved 18 Oct 2026
- SecurityTrust Center, retrieved 14 Oct 2026
- Privacy Policy (as of 2026-08-03)Privacy notice, retrieved 14 Oct 2026
- Data Processing Agreement (as of 2026-04-01)DPA, retrieved 18 Oct 2026
- Subprocessors (as of August 2026)Sub-processor list, retrieved 14 Oct 2026
- Terms of Service (as of 2026-08-03)Terms and conditions, retrieved 18 Oct 2026
- Docs: Model improvementDocumentation, retrieved 18 Oct 2026
- Docs: GeographyDocumentation, retrieved 18 Oct 2026
- Replit's Trust CenterTrust Center, retrieved 18 Oct 2026
- Docs: Account InactivityDocumentation, retrieved 18 Oct 2026
- Docs: Deleting your dataDocumentation, retrieved 18 Oct 2026
| Feature | GitHub Copilot | Replit |
|---|---|---|
|
| |
| Details: DPA available |
|
|
|
| |
| Details: Training on inputs |
|
|
| differs by tool |
|
|
| Details: Data residency |
|
|
| list availableall 7 plans | list availableall 4 plans | |
| Details: List published |
|
|
| differs by tool |
| DPA: customer may request return or…all 4 plans |
| Details: Data retention |
|
|
| differs by tool |
|
|
| Details: Price |
|
|
| yesall 7 plans | yesall 4 plans | |
| Details: AI features included |
|
|
| 13 sources | 12 sources | |
| Details: Sources with retrieval date |
|
|
Contract / DPA
- GitHub Copilot
- not publicly documentedFree, Student, Pro, Pro+, Max
- yesBusiness, Enterprise
- Replit
- not publicly documentedStarter (free of charge), Core
- yesPro, Enterprise
- GitHub Copilot
- Free
not publicly documented: according to q1, Copilot Free/Pro/Pro+/Max involve data processing by GitHub as controller (reference to Terms of Service and Privacy Statement); the DPA is mentioned in q1/q8 only in connection with Business/Enterprise
- Student
not publicly documented: according to q1, Copilot Free/Pro/Pro+/Max involve data processing by GitHub as controller (reference to Terms of Service and Privacy Statement); the DPA is mentioned in q1/q8 only in connection with Business/Enterprise
- Pro
not publicly documented: according to q1, Copilot Free/Pro/Pro+/Max involve data processing by GitHub as controller (reference to Terms of Service and Privacy Statement); the DPA is mentioned in q1/q8 only in connection with Business/Enterprise
- Pro+
not publicly documented: according to q1, Copilot Free/Pro/Pro+/Max involve data processing by GitHub as controller (reference to Terms of Service and Privacy Statement); the DPA is mentioned in q1/q8 only in connection with Business/Enterprise
- Max
not publicly documented: according to q1, Copilot Free/Pro/Pro+/Max involve data processing by GitHub as controller (reference to Terms of Service and Privacy Statement); the DPA is mentioned in q1/q8 only in connection with Business/Enterprise
- Business
yes: Copilot is covered by the GitHub Data Protection Agreement, which applies to all generally available (GA) Copilot features and the previews listed in 'GitHub DPA-Covered Previews' (q8); GitHub and customers 'can enter a Data Protection Agreement that supports compliance with the GDPR' (q1). For purchases directly from GitHub, the GitHub Generative AI Services Terms apply; for purchases via Microsoft, the Microsoft Product Terms apply (q8).
Provider’s DPA - Enterprise
yes: as Business (GitHub Data Protection Agreement for GA features and listed DPA previews; q8, q1).
Provider’s DPA
Replit- Starter (free of charge)
not publicly documented (the DPA forms part of the Replit Commercial Agreement; according to the Terms, this applies to Pro and Enterprise)
- Core
not publicly documented, whether included in the plan (the DPA forms part of the Replit Commercial Agreement; according to the Terms, this applies to Pro and Enterprise)
- Pro
yes (DPA forms part of the Replit Commercial Agreement; EU SCCs Module Two/Three, UK Addendum; general authorisation for sub-processors)
Provider’s DPA - Enterprise
yes (DPA forms part of the Replit Commercial Agreement)
Provider’s DPA
- Free
Training
- GitHub Copilot
- opt-out availableFree, Pro, Pro+, Max
- not publicly documentedStudent
- noBusiness, Enterprise
- Replit
- not publicly documentedStarter (free of charge), Core
- opt-out availablePro
- noEnterprise
- GitHub Copilot
- Free
GitHub Docs "Managing Copilot policies as an individual subscriber" (q14): "Starting on April 24, 2026, if you have a Copilot Free, Copilot Pro, Copilot Pro+, or Copilot Max plan, GitHub may use your interactions with GitHub features and services—including inputs, outputs, code snippets, and associated context—to train and improve AI models." Opt-out via the setting "Allow GitHub to use my data for AI model training" = Disabled (q14) or https://github.com/settings/copilot/features: "Individual subscribers can opt out of having their data used for AI model training at any time." (q1). q3: the same applies to Copilot Free, Pro, Pro+ and Max "in accordance with our GitHub General Privacy Statement and applicable user settings".
- Student
q1, q3 and q14 expressly state the training rule for Copilot Free, Pro, Pro+ and Max (q14: "Starting on April 24, 2026, if you have a Copilot Free, Copilot Pro, Copilot Pro+, or Copilot Max plan ..."). Copilot Student is not mentioned in these sentences; the retrieved primary sources contain no separate statement on Student. The Copilot Trust Center FAQ (q16) likewise states the training rule only for "Individual (Free/Pro/Pro+/Max) Subscribers"; the documentation page on Copilot Student (q17) contains no statement on training.
- Pro
GitHub Docs "Managing Copilot policies as an individual subscriber" (q14): "Starting on April 24, 2026, if you have a Copilot Free, Copilot Pro, Copilot Pro+, or Copilot Max plan, GitHub may use your interactions with GitHub features and services—including inputs, outputs, code snippets, and associated context—to train and improve AI models." Opt-out via the setting "Allow GitHub to use my data for AI model training" = Disabled (q14) or https://github.com/settings/copilot/features: "Individual subscribers can opt out of having their data used for AI model training at any time." (q1). q3: the same applies to Copilot Free, Pro, Pro+ and Max "in accordance with our GitHub General Privacy Statement and applicable user settings".
- Pro+
GitHub Docs "Managing Copilot policies as an individual subscriber" (q14): "Starting on April 24, 2026, if you have a Copilot Free, Copilot Pro, Copilot Pro+, or Copilot Max plan, GitHub may use your interactions with GitHub features and services—including inputs, outputs, code snippets, and associated context—to train and improve AI models." Opt-out via the setting "Allow GitHub to use my data for AI model training" = Disabled (q14) or https://github.com/settings/copilot/features: "Individual subscribers can opt out of having their data used for AI model training at any time." (q1). q3: the same applies to Copilot Free, Pro, Pro+ and Max "in accordance with our GitHub General Privacy Statement and applicable user settings".
- Max
GitHub Docs "Managing Copilot policies as an individual subscriber" (q14): "Starting on April 24, 2026, if you have a Copilot Free, Copilot Pro, Copilot Pro+, or Copilot Max plan, GitHub may use your interactions with GitHub features and services—including inputs, outputs, code snippets, and associated context—to train and improve AI models." Opt-out via the setting "Allow GitHub to use my data for AI model training" = Disabled (q14) or https://github.com/settings/copilot/features: "Individual subscribers can opt out of having their data used for AI model training at any time." (q1). q3: the same applies to Copilot Free, Pro, Pro+ and Max "in accordance with our GitHub General Privacy Statement and applicable user settings".
- Business
"No. GitHub does not use either Copilot Business or Enterprise data to train its models." (q1); q3: "GitHub does not use Copilot Business or Copilot Enterprise customer data to train AI models." Third-party models: according to q3, OpenAI, among others, "do not train models on customer business data", Google/Gemini does not use prompts for training, zero data retention agreements with OpenAI, Anthropic, xAI and Fireworks AI (details per provider in q3). q14: "Copilot Business and Copilot Enterprise customers' data is protected under GitHub's Data Protection Agreement, which prohibits such use without customer authorization."
- Enterprise
"GitHub does not use either Copilot Business or Enterprise data to train its models." (q1, q3). q14: "Copilot Business and Copilot Enterprise customers' data is protected under GitHub's Data Protection Agreement, which prohibits such use without customer authorization."
Replit- Starter (free of charge)
Privacy Policy (as of 2026-08-03): legitimate interest in using personal data 'to improve the accuracy of our machine learning technologies such as code generation'. Terms: Replit may view the content of private apps, including to improve the service. Documentation 'Model improvement' (q7): opt-out from the use of content for model development only for Pro users (Settings > Personalization > Model Improvement); for Enterprise, Replit does not use customer content for training. Default setting not documented. No opt-out is documented for Starter.
- Core
Privacy Policy (as of 2026-08-03): legitimate interest in using personal data 'to improve the accuracy of our machine learning technologies such as code generation'. Terms: Replit may view the content of private apps, including to improve the service. Documentation 'Model improvement' (q7): opt-out from the use of content for model development only for Pro users (Settings > Personalization > Model Improvement); for Enterprise, Replit does not use customer content for training. Default setting not documented. No opt-out is documented for Core.
- Pro
Privacy Policy (as of 2026-08-03): legitimate interest in using personal data 'to improve the accuracy of our machine learning technologies such as code generation'. Terms: Replit may view the content of private apps, including to improve the service. Documentation 'Model improvement' (q7): opt-out from the use of content for model development only for Pro users (Settings > Personalization > Model Improvement); for Enterprise, Replit does not use customer content for training. Default setting not documented. According to the documentation, the opt-out applies only to new content and does not delete any data; processing for operation, security and troubleshooting continues.
- Enterprise
Documentation 'Model improvement' (q7): 'For Enterprise users, Replit does not use customer content to train its models.' Pricing page lists 'Advanced privacy controls' and 'Single-tenant environments' for Enterprise. Privacy Policy (as of 2026-08-03): legitimate interest in using personal data 'to improve the accuracy of our machine learning technologies such as code generation'. Terms: Replit may view the content of private apps, including to improve the service.
- Free
Hosting
- differs by tool
- GitHub Copilot
- mixedFree, Student, Pro, Pro+, Max
- EU optionBusiness, Enterprise
- Replit
- US onlyStarter (free of charge)
- mixedCore, Pro, Enterprise
- GitHub Copilot
- Free
GitHub General Privacy Statement (q11): "GitHub stores and processes Personal Data in a variety of locations, including your local region, the United States, and other countries where GitHub, its affiliates, subsidiaries, or subprocessors have operations." q7: "By default, GitHub stores data for GitHub.com in the USA." Regional data residency (EU) is available only via GitHub Enterprise Cloud with GHE.com; there, "Copilot Individual" is not available to managed users (q7). q3: models are hosted by OpenAI, Azure, Anthropic, Google and others; inline suggestions on the Free and Student plans run on Fireworks AI.
- Student
GitHub General Privacy Statement (q11): "GitHub stores and processes Personal Data in a variety of locations, including your local region, the United States, and other countries where GitHub, its affiliates, subsidiaries, or subprocessors have operations." q7: "By default, GitHub stores data for GitHub.com in the USA." Regional data residency (EU) is available only via GitHub Enterprise Cloud with GHE.com; there, "Copilot Individual" is not available to managed users (q7). q3: models are hosted by OpenAI, Azure, Anthropic, Google and others; inline suggestions on the Free and Student plans run on Fireworks AI.
- Pro
GitHub General Privacy Statement (q11): "GitHub stores and processes Personal Data in a variety of locations, including your local region, the United States, and other countries where GitHub, its affiliates, subsidiaries, or subprocessors have operations." q7: "By default, GitHub stores data for GitHub.com in the USA." Regional data residency (EU) is available only via GitHub Enterprise Cloud with GHE.com; there, "Copilot Individual" is not available to managed users (q7). q3: models are hosted by OpenAI, Azure, Anthropic, Google and others; inline suggestions on the Free and Student plans run on Fireworks AI.
- Pro+
GitHub General Privacy Statement (q11): "GitHub stores and processes Personal Data in a variety of locations, including your local region, the United States, and other countries where GitHub, its affiliates, subsidiaries, or subprocessors have operations." q7: "By default, GitHub stores data for GitHub.com in the USA." Regional data residency (EU) is available only via GitHub Enterprise Cloud with GHE.com; there, "Copilot Individual" is not available to managed users (q7). q3: models are hosted by OpenAI, Azure, Anthropic, Google and others; inline suggestions on the Free and Student plans run on Fireworks AI.
- Max
GitHub General Privacy Statement (q11): "GitHub stores and processes Personal Data in a variety of locations, including your local region, the United States, and other countries where GitHub, its affiliates, subsidiaries, or subprocessors have operations." q7: "By default, GitHub stores data for GitHub.com in the USA." Regional data residency (EU) is available only via GitHub Enterprise Cloud with GHE.com; there, "Copilot Individual" is not available to managed users (q7). q3: models are hosted by OpenAI, Azure, Anthropic, Google and others; inline suggestions on the Free and Student plans run on Fireworks AI.
- Business
Default on github.com: storage in the USA (q7). EU data residency via GitHub Enterprise Cloud with GHE.com: Copilot Business or Enterprise can be assigned there (q7). With the policy 'Restrict Copilot to data residency compliant models', according to q6, 'all inference processing and associated data' remain in the selected region (EU or USA); policy disabled by default, additional consumption +10 % AI Credits (q6). Without this policy, according to q5, Copilot data and logs are 'by default stored outside your region'. Inline suggestions: models hosted on Azure (q3).
- Enterprise
As Business: default USA (q7); EU data residency via GHE.com with the policy 'Restrict Copilot to data residency compliant models' (q6, q5). q6 lists models of the GPT and Claude series for the EU; according to q6, model availability per region changes continuously. Not all Copilot features are available on GHE.com (q7).
Replit- Starter (free of charge)
Trust Center (FAQ): production infrastructure 'runs entirely on Google Cloud Platform (GCP), in the United States'; 'Data residency can be configured per customer needs'. Security page: a separate, isolated GCP project per customer. Privacy Policy: services hosted primarily in the USA. Docs 'Geography': workspace region (North America, EU, Asia) selectable only on Pro; publishing region (North America, EU, Asia, South America, Australia) on Core, Pro and Enterprise; free accounts publish to North America by default; region cannot be changed after publishing. The page does not state where AI requests are processed; according to the list, the AI sub-processors are located in the USA. Starter: no choice of region documented.
- Core
Trust Center (FAQ): production infrastructure 'runs entirely on Google Cloud Platform (GCP), in the United States'; 'Data residency can be configured per customer needs'. Security page: a separate, isolated GCP project per customer. Privacy Policy: services hosted primarily in the USA. Docs 'Geography': workspace region (North America, EU, Asia) selectable only on Pro; publishing region (North America, EU, Asia, South America, Australia) on Core, Pro and Enterprise; free accounts publish to North America by default; region cannot be changed after publishing. The page does not state where AI requests are processed; according to the list, the AI sub-processors are located in the USA. Core: publishing region (including EU) selectable, workspace region not.
- Pro
Trust Center (FAQ): production infrastructure 'runs entirely on Google Cloud Platform (GCP), in the United States'; 'Data residency can be configured per customer needs'. Security page: a separate, isolated GCP project per customer. Privacy Policy: services hosted primarily in the USA. Docs 'Geography': workspace region (North America, EU, Asia) selectable only on Pro; publishing region (North America, EU, Asia, South America, Australia) on Core, Pro and Enterprise; free accounts publish to North America by default; region cannot be changed after publishing. The page does not state where AI requests are processed; according to the list, the AI sub-processors are located in the USA. Pro: workspace and publishing region selectable (including EU).
- Enterprise
Trust Center (FAQ): production infrastructure 'runs entirely on Google Cloud Platform (GCP), in the United States'; 'Data residency can be configured per customer needs'. Security page: a separate, isolated GCP project per customer. Privacy Policy: services hosted primarily in the USA. Docs 'Geography': workspace region (North America, EU, Asia) selectable only on Pro; publishing region (North America, EU, Asia, South America, Australia) on Core, Pro and Enterprise; free accounts publish to North America by default; region cannot be changed after publishing. The page does not state where AI requests are processed; according to the list, the AI sub-processors are located in the USA. Enterprise: publishing region selectable and enforceable organisation-wide; the documentation names the workspace region choice only for Pro.
- Free
Sub-processors
- GitHub Copilotlist availableall 7 plans
- Replitlist availableall 4 plans
- GitHub Copilot
- Free
- According to q4, the list applies to 'GitHub services governed by the GitHub Data Protection Agreement' (Enterprise customers); not expressly assigned to individual plans without a DPA. No separate list reference found for individual plans (reference to Privacy Statement q11).
- Third-party providers as per the list (as retrieved 2026-10-07): Amazon Web Services Inc (AWS) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States United States; Anthropic PBC AI Inference and AI Services United States United States; Cerebras Systems Inc. AI Inference and AI Services United States United States; Cloudflare Content delivery service United States United States; DataDome Solutions, Inc. Security management United States, France United States; Elasticsearch, Inc. Cloud Hosted Infrastructure United States United States; Fastly Content delivery service United States United States; Fireworks AI AI Inference and AI Services United States, Germany, Iceland United States; FullStory, Inc. Customer support ticketing analysis United States United States; Google Cloud Platform (GCP) Cloud Hosted Infrastructure, AI Inference and AI Services United States, Belgium, Singapore United States; Hewlett-Packard Limited Cloud Hosted Infrastructure United States United States; LambdaTest Cloud Hosted Infrastructure United States United States; Microsoft (Azure) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States, Canada, Chile, Mexico United States; Microsoft (Azure) Cognitive Services and customer support ticketing analysis United States United States; Microsoft Technical Services United States, Australia, Brazil, Canada, France, Japan, Norway, Spain, Sweden, Switzerland, United Kingdom United States; Moveworks Customer support ticketing analysis United States United States; NexMo Inc (aka Vonage) SMS notification provider for 2 Factor Authentication United States United States; Obsidian Security Security management United States United States; OpenAI AI Inference and AI Services United States United States; Oracle America, Inc. Cloud Hosted Infrastructure United States United States; Pusher Building and managing real-time infrastructure for web and mobile applications United States United States; Tines Automation Inc. Security management United States United States; Twilio (SendGrid) SMS notification provider for 2 Factor Authentication United States United States; xAI AI Inference and AI Services United States United States; Zendesk Customer support ticketing system United States United States
- Student
- According to q4, the list applies to 'GitHub services governed by the GitHub Data Protection Agreement' (Enterprise customers); not expressly assigned to individual plans without a DPA. No separate list reference found for individual plans (reference to Privacy Statement q11).
- Third-party providers as per the list (as retrieved 2026-10-07): Amazon Web Services Inc (AWS) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States United States; Anthropic PBC AI Inference and AI Services United States United States; Cerebras Systems Inc. AI Inference and AI Services United States United States; Cloudflare Content delivery service United States United States; DataDome Solutions, Inc. Security management United States, France United States; Elasticsearch, Inc. Cloud Hosted Infrastructure United States United States; Fastly Content delivery service United States United States; Fireworks AI AI Inference and AI Services United States, Germany, Iceland United States; FullStory, Inc. Customer support ticketing analysis United States United States; Google Cloud Platform (GCP) Cloud Hosted Infrastructure, AI Inference and AI Services United States, Belgium, Singapore United States; Hewlett-Packard Limited Cloud Hosted Infrastructure United States United States; LambdaTest Cloud Hosted Infrastructure United States United States; Microsoft (Azure) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States, Canada, Chile, Mexico United States; Microsoft (Azure) Cognitive Services and customer support ticketing analysis United States United States; Microsoft Technical Services United States, Australia, Brazil, Canada, France, Japan, Norway, Spain, Sweden, Switzerland, United Kingdom United States; Moveworks Customer support ticketing analysis United States United States; NexMo Inc (aka Vonage) SMS notification provider for 2 Factor Authentication United States United States; Obsidian Security Security management United States United States; OpenAI AI Inference and AI Services United States United States; Oracle America, Inc. Cloud Hosted Infrastructure United States United States; Pusher Building and managing real-time infrastructure for web and mobile applications United States United States; Tines Automation Inc. Security management United States United States; Twilio (SendGrid) SMS notification provider for 2 Factor Authentication United States United States; xAI AI Inference and AI Services United States United States; Zendesk Customer support ticketing system United States United States
- Pro
- According to q4, the list applies to 'GitHub services governed by the GitHub Data Protection Agreement' (Enterprise customers); not expressly assigned to individual plans without a DPA. No separate list reference found for individual plans (reference to Privacy Statement q11).
- Third-party providers as per the list (as retrieved 2026-10-07): Amazon Web Services Inc (AWS) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States United States; Anthropic PBC AI Inference and AI Services United States United States; Cerebras Systems Inc. AI Inference and AI Services United States United States; Cloudflare Content delivery service United States United States; DataDome Solutions, Inc. Security management United States, France United States; Elasticsearch, Inc. Cloud Hosted Infrastructure United States United States; Fastly Content delivery service United States United States; Fireworks AI AI Inference and AI Services United States, Germany, Iceland United States; FullStory, Inc. Customer support ticketing analysis United States United States; Google Cloud Platform (GCP) Cloud Hosted Infrastructure, AI Inference and AI Services United States, Belgium, Singapore United States; Hewlett-Packard Limited Cloud Hosted Infrastructure United States United States; LambdaTest Cloud Hosted Infrastructure United States United States; Microsoft (Azure) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States, Canada, Chile, Mexico United States; Microsoft (Azure) Cognitive Services and customer support ticketing analysis United States United States; Microsoft Technical Services United States, Australia, Brazil, Canada, France, Japan, Norway, Spain, Sweden, Switzerland, United Kingdom United States; Moveworks Customer support ticketing analysis United States United States; NexMo Inc (aka Vonage) SMS notification provider for 2 Factor Authentication United States United States; Obsidian Security Security management United States United States; OpenAI AI Inference and AI Services United States United States; Oracle America, Inc. Cloud Hosted Infrastructure United States United States; Pusher Building and managing real-time infrastructure for web and mobile applications United States United States; Tines Automation Inc. Security management United States United States; Twilio (SendGrid) SMS notification provider for 2 Factor Authentication United States United States; xAI AI Inference and AI Services United States United States; Zendesk Customer support ticketing system United States United States
- Pro+
- According to q4, the list applies to 'GitHub services governed by the GitHub Data Protection Agreement' (Enterprise customers); not expressly assigned to individual plans without a DPA. No separate list reference found for individual plans (reference to Privacy Statement q11).
- Third-party providers as per the list (as retrieved 2026-10-07): Amazon Web Services Inc (AWS) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States United States; Anthropic PBC AI Inference and AI Services United States United States; Cerebras Systems Inc. AI Inference and AI Services United States United States; Cloudflare Content delivery service United States United States; DataDome Solutions, Inc. Security management United States, France United States; Elasticsearch, Inc. Cloud Hosted Infrastructure United States United States; Fastly Content delivery service United States United States; Fireworks AI AI Inference and AI Services United States, Germany, Iceland United States; FullStory, Inc. Customer support ticketing analysis United States United States; Google Cloud Platform (GCP) Cloud Hosted Infrastructure, AI Inference and AI Services United States, Belgium, Singapore United States; Hewlett-Packard Limited Cloud Hosted Infrastructure United States United States; LambdaTest Cloud Hosted Infrastructure United States United States; Microsoft (Azure) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States, Canada, Chile, Mexico United States; Microsoft (Azure) Cognitive Services and customer support ticketing analysis United States United States; Microsoft Technical Services United States, Australia, Brazil, Canada, France, Japan, Norway, Spain, Sweden, Switzerland, United Kingdom United States; Moveworks Customer support ticketing analysis United States United States; NexMo Inc (aka Vonage) SMS notification provider for 2 Factor Authentication United States United States; Obsidian Security Security management United States United States; OpenAI AI Inference and AI Services United States United States; Oracle America, Inc. Cloud Hosted Infrastructure United States United States; Pusher Building and managing real-time infrastructure for web and mobile applications United States United States; Tines Automation Inc. Security management United States United States; Twilio (SendGrid) SMS notification provider for 2 Factor Authentication United States United States; xAI AI Inference and AI Services United States United States; Zendesk Customer support ticketing system United States United States
- Max
- According to q4, the list applies to 'GitHub services governed by the GitHub Data Protection Agreement' (Enterprise customers); not expressly assigned to individual plans without a DPA. No separate list reference found for individual plans (reference to Privacy Statement q11).
- Third-party providers as per the list (as retrieved 2026-10-07): Amazon Web Services Inc (AWS) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States United States; Anthropic PBC AI Inference and AI Services United States United States; Cerebras Systems Inc. AI Inference and AI Services United States United States; Cloudflare Content delivery service United States United States; DataDome Solutions, Inc. Security management United States, France United States; Elasticsearch, Inc. Cloud Hosted Infrastructure United States United States; Fastly Content delivery service United States United States; Fireworks AI AI Inference and AI Services United States, Germany, Iceland United States; FullStory, Inc. Customer support ticketing analysis United States United States; Google Cloud Platform (GCP) Cloud Hosted Infrastructure, AI Inference and AI Services United States, Belgium, Singapore United States; Hewlett-Packard Limited Cloud Hosted Infrastructure United States United States; LambdaTest Cloud Hosted Infrastructure United States United States; Microsoft (Azure) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States, Canada, Chile, Mexico United States; Microsoft (Azure) Cognitive Services and customer support ticketing analysis United States United States; Microsoft Technical Services United States, Australia, Brazil, Canada, France, Japan, Norway, Spain, Sweden, Switzerland, United Kingdom United States; Moveworks Customer support ticketing analysis United States United States; NexMo Inc (aka Vonage) SMS notification provider for 2 Factor Authentication United States United States; Obsidian Security Security management United States United States; OpenAI AI Inference and AI Services United States United States; Oracle America, Inc. Cloud Hosted Infrastructure United States United States; Pusher Building and managing real-time infrastructure for web and mobile applications United States United States; Tines Automation Inc. Security management United States United States; Twilio (SendGrid) SMS notification provider for 2 Factor Authentication United States United States; xAI AI Inference and AI Services United States United States; Zendesk Customer support ticketing system United States United States
- Business
- Third-party providers as per the list (as retrieved 2026-10-07): Amazon Web Services Inc (AWS) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States United States; Anthropic PBC AI Inference and AI Services United States United States; Cerebras Systems Inc. AI Inference and AI Services United States United States; Cloudflare Content delivery service United States United States; DataDome Solutions, Inc. Security management United States, France United States; Elasticsearch, Inc. Cloud Hosted Infrastructure United States United States; Fastly Content delivery service United States United States; Fireworks AI AI Inference and AI Services United States, Germany, Iceland United States; FullStory, Inc. Customer support ticketing analysis United States United States; Google Cloud Platform (GCP) Cloud Hosted Infrastructure, AI Inference and AI Services United States, Belgium, Singapore United States; Hewlett-Packard Limited Cloud Hosted Infrastructure United States United States; LambdaTest Cloud Hosted Infrastructure United States United States; Microsoft (Azure) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States, Canada, Chile, Mexico United States; Microsoft (Azure) Cognitive Services and customer support ticketing analysis United States United States; Microsoft Technical Services United States, Australia, Brazil, Canada, France, Japan, Norway, Spain, Sweden, Switzerland, United Kingdom United States; Moveworks Customer support ticketing analysis United States United States; NexMo Inc (aka Vonage) SMS notification provider for 2 Factor Authentication United States United States; Obsidian Security Security management United States United States; OpenAI AI Inference and AI Services United States United States; Oracle America, Inc. Cloud Hosted Infrastructure United States United States; Pusher Building and managing real-time infrastructure for web and mobile applications United States United States; Tines Automation Inc. Security management United States United States; Twilio (SendGrid) SMS notification provider for 2 Factor Authentication United States United States; xAI AI Inference and AI Services United States United States; Zendesk Customer support ticketing system United States United States
- GitHub subsidiaries as per the list: GitHub Australia Pty Ltd, GitHub BV (NL), GitHub Canada ULC, GitHub Germany GmbH, GitHub India Pty Ltd, npm Inc, Semmle Inc
- Enterprise
- Third-party providers as per the list (as retrieved 2026-10-07): Amazon Web Services Inc (AWS) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States United States; Anthropic PBC AI Inference and AI Services United States United States; Cerebras Systems Inc. AI Inference and AI Services United States United States; Cloudflare Content delivery service United States United States; DataDome Solutions, Inc. Security management United States, France United States; Elasticsearch, Inc. Cloud Hosted Infrastructure United States United States; Fastly Content delivery service United States United States; Fireworks AI AI Inference and AI Services United States, Germany, Iceland United States; FullStory, Inc. Customer support ticketing analysis United States United States; Google Cloud Platform (GCP) Cloud Hosted Infrastructure, AI Inference and AI Services United States, Belgium, Singapore United States; Hewlett-Packard Limited Cloud Hosted Infrastructure United States United States; LambdaTest Cloud Hosted Infrastructure United States United States; Microsoft (Azure) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States, Canada, Chile, Mexico United States; Microsoft (Azure) Cognitive Services and customer support ticketing analysis United States United States; Microsoft Technical Services United States, Australia, Brazil, Canada, France, Japan, Norway, Spain, Sweden, Switzerland, United Kingdom United States; Moveworks Customer support ticketing analysis United States United States; NexMo Inc (aka Vonage) SMS notification provider for 2 Factor Authentication United States United States; Obsidian Security Security management United States United States; OpenAI AI Inference and AI Services United States United States; Oracle America, Inc. Cloud Hosted Infrastructure United States United States; Pusher Building and managing real-time infrastructure for web and mobile applications United States United States; Tines Automation Inc. Security management United States United States; Twilio (SendGrid) SMS notification provider for 2 Factor Authentication United States United States; xAI AI Inference and AI Services United States United States; Zendesk Customer support ticketing system United States United States
- GitHub subsidiaries as per the list: GitHub Australia Pty Ltd, GitHub BV (NL), GitHub Canada ULC, GitHub Germany GmbH, GitHub India Pty Ltd, npm Inc, Semmle Inc
Replit- Starter (free of charge)
- Cloud/hosting: Google (cloud infrastructure and AI models), Microsoft Azure, Cloudflare, HashiCorp Cloud, Neon (database) – all USA
- AI models and infrastructure: Anthropic, OpenAI, OpenRouter, Baseten, Fireworks AI, Parallel Web Systems, Firecrawl, Anima App – all USA
- Others (extract): Stripe, Orb, Verifi, Clazar (payment/billing), Clerk, Stytch, WorkOS (identity/SSO), Datadog, Sentry, Grafana Labs (monitoring), Zendesk, Common Room, Civilized Discourse Construction Kit, IntouchCX (Canada), OWND ApS/Parahelp (support), analytics/marketing services (including Amplitude, Segment, HubSpot, ZoomInfo – USA)
- Full list (around 50 entries) see subprocessorUrl; all except IntouchCX (Canada) located in the USA
- Core
- Cloud/hosting: Google (cloud infrastructure and AI models), Microsoft Azure, Cloudflare, HashiCorp Cloud, Neon (database) – all USA
- AI models and infrastructure: Anthropic, OpenAI, OpenRouter, Baseten, Fireworks AI, Parallel Web Systems, Firecrawl, Anima App – all USA
- Others (extract): Stripe, Orb, Verifi, Clazar (payment/billing), Clerk, Stytch, WorkOS (identity/SSO), Datadog, Sentry, Grafana Labs (monitoring), Zendesk, Common Room, Civilized Discourse Construction Kit, IntouchCX (Canada), OWND ApS/Parahelp (support), analytics/marketing services (including Amplitude, Segment, HubSpot, ZoomInfo – USA)
- Full list (around 50 entries) see subprocessorUrl; all except IntouchCX (Canada) located in the USA
- Pro
- Cloud/hosting: Google (cloud infrastructure and AI models), Microsoft Azure, Cloudflare, HashiCorp Cloud, Neon (database) – all USA
- AI models and infrastructure: Anthropic, OpenAI, OpenRouter, Baseten, Fireworks AI, Parallel Web Systems, Firecrawl, Anima App – all USA
- Others (extract): Stripe, Orb, Verifi, Clazar (payment/billing), Clerk, Stytch, WorkOS (identity/SSO), Datadog, Sentry, Grafana Labs (monitoring), Zendesk, Common Room, Civilized Discourse Construction Kit, IntouchCX (Canada), OWND ApS/Parahelp (support), analytics/marketing services (including Amplitude, Segment, HubSpot, ZoomInfo – USA)
- Full list (around 50 entries) see subprocessorUrl; all except IntouchCX (Canada) located in the USA
- Enterprise
- Cloud/hosting: Google (cloud infrastructure and AI models), Microsoft Azure, Cloudflare, HashiCorp Cloud, Neon (database) – all USA
- AI models and infrastructure: Anthropic, OpenAI, OpenRouter, Baseten, Fireworks AI, Parallel Web Systems, Firecrawl, Anima App – all USA
- Others (extract): Stripe, Orb, Verifi, Clazar (payment/billing), Clerk, Stytch, WorkOS (identity/SSO), Datadog, Sentry, Grafana Labs (monitoring), Zendesk, Common Room, Civilized Discourse Construction Kit, IntouchCX (Canada), OWND ApS/Parahelp (support), analytics/marketing services (including Amplitude, Segment, HubSpot, ZoomInfo – USA)
- Full list (around 50 entries) see subprocessorUrl; all except IntouchCX (Canada) located in the USA
- Free
Retention
- differs by tool
- GitHub Copilot
- not publicly documentedFree, Student, Pro, Pro+, Max
- Default settings according to q1: access…Business, Enterprise
- ReplitDPA: customer may request return or…all 4 plans
- GitHub Copilot
- Freenot publicly documented: q1 states default retention only for Business/Enterprise ('The default settings for Copilot Business and Enterprise Customers are as follows'); no period for individual plans on the retrieved pages. Copilot Trust Center FAQ (q16): GitHub uses Copilot data from individual subscribers "for all the operational purposes described above for Business/Enterprise subscribers"; the FAQ gives no period for individual plans; Feedback Data "is retained as long as necessary".
- Studentnot publicly documented: q1 states default retention only for Business/Enterprise ('The default settings for Copilot Business and Enterprise Customers are as follows'); no period for individual plans on the retrieved pages. Copilot Trust Center FAQ (q16): GitHub uses Copilot data from individual subscribers "for all the operational purposes described above for Business/Enterprise subscribers"; the FAQ gives no period for individual plans; Feedback Data "is retained as long as necessary".
- Pronot publicly documented: q1 states default retention only for Business/Enterprise ('The default settings for Copilot Business and Enterprise Customers are as follows'); no period for individual plans on the retrieved pages. Copilot Trust Center FAQ (q16): GitHub uses Copilot data from individual subscribers "for all the operational purposes described above for Business/Enterprise subscribers"; the FAQ gives no period for individual plans; Feedback Data "is retained as long as necessary".
- Pro+not publicly documented: q1 states default retention only for Business/Enterprise ('The default settings for Copilot Business and Enterprise Customers are as follows'); no period for individual plans on the retrieved pages. Copilot Trust Center FAQ (q16): GitHub uses Copilot data from individual subscribers "for all the operational purposes described above for Business/Enterprise subscribers"; the FAQ gives no period for individual plans; Feedback Data "is retained as long as necessary".
- Maxnot publicly documented: q1 states default retention only for Business/Enterprise ('The default settings for Copilot Business and Enterprise Customers are as follows'); no period for individual plans on the retrieved pages. Copilot Trust Center FAQ (q16): GitHub uses Copilot data from individual subscribers "for all the operational purposes described above for Business/Enterprise subscribers"; the FAQ gives no period for individual plans; Feedback Data "is retained as long as necessary".
- BusinessDefault settings according to q1: access via IDE (chat and code completions): prompts and suggestions "Not retained"; User Engagement Data two years; Feedback Data "as long as needed for its intended purpose". All other access routes (including github.com, Mobile, CLI): prompts and suggestions 28 days; User Engagement Data two years. DPA (October 2025 version), Section 8: after the end of the services, GitHub deletes the Customer Personal Data or returns it at the customer's choice and deletes existing copies "in accordance with our retention and deletion policy" (q13). Unlike q1, the Copilot Trust Center FAQ (q16) assigns Copilot CLI to IDE access: inputs and outputs "Not retained by default" (exception: time-limited retention in the event of confirmed violations of the Acceptable Use Policies or Terms of Service); other access: "Retained for up to 28 days by default".
- EnterpriseDefault settings according to q1: access via IDE (chat and code completions): prompts and suggestions "Not retained"; User Engagement Data two years; Feedback Data "as long as needed for its intended purpose". All other access routes (including github.com, Mobile, CLI): prompts and suggestions 28 days; User Engagement Data two years. DPA (October 2025 version), Section 8: after the end of the services, GitHub deletes the Customer Personal Data or returns it at the customer's choice and deletes existing copies "in accordance with our retention and deletion policy" (q13). Unlike q1, the Copilot Trust Center FAQ (q16) assigns Copilot CLI to IDE access: inputs and outputs "Not retained by default" (exception: time-limited retention in the event of confirmed violations of the Acceptable Use Policies or Terms of Service); other access: "Retained for up to 28 days by default".
Replit- Starter (free of charge)DPA: customer may request return or deletion of customer data up to 90 days after the end of the contract. Docs 'Deleting your data': account deletion removes all content, personal information is 'purged from our systems'; no time limits. Privacy Policy: deletion or de-identification once no longer needed in identifiable form; no specific time limits. Retention periods for project content and prompts during operation: not publicly documented. Docs 'Account Inactivity': accounts not used within one year are considered inactive; Replit may terminate inactive accounts and delete data, for free accounts the apps are deleted.
- CoreDPA: customer may request return or deletion of customer data up to 90 days after the end of the contract. Docs 'Deleting your data': account deletion removes all content, personal information is 'purged from our systems'; no time limits. Privacy Policy: deletion or de-identification once no longer needed in identifiable form; no specific time limits. Retention periods for project content and prompts during operation: not publicly documented. Docs 'Account Inactivity': paid subscriptions are not terminated for inactivity.
- ProDPA: customer may request return or deletion of customer data up to 90 days after the end of the contract. Docs 'Deleting your data': account deletion removes all content, personal information is 'purged from our systems'; no time limits. Privacy Policy: deletion or de-identification once no longer needed in identifiable form; no specific time limits. Retention periods for project content and prompts during operation: not publicly documented. Docs 'Account Inactivity': paid subscriptions are not terminated for inactivity. Pricing page: database rollback up to 28 days.
- EnterpriseDPA: customer may request return or deletion of customer data up to 90 days after the end of the contract. Docs 'Deleting your data': account deletion removes all content, personal information is 'purged from our systems'; no time limits. Privacy Policy: deletion or de-identification once no longer needed in identifiable form; no specific time limits. Retention periods for project content and prompts during operation: not publicly documented. Docs 'Account Inactivity': paid subscriptions are not terminated for inactivity.
Price
- differs by tool
- GitHub Copilot
- 0 USDFree, Student
- 10 USD/moPro
- 39 USD/moPro+
- 100 USD/moMax
- 19 USD/user/moBusiness
- 39 USD/user/moEnterprise
- Replit
- 0 USDStarter (free of charge)
- 20 USD/mo… (further prices in the details)Core
- 100 USD/mo… (further prices in the details)Pro
- customEnterprise
- GitHub Copilot
- Free
0 USD (q2)
- Student
0 USD for verified students (q2)
- Pro
10 USD/month (q2; free of charge for some user groups)
- Pro+
39 USD/month (q2)
- Max
100 USD/month (q2)
- Business
19 USD per assigned seat/month (q2)
- Enterprise
39 USD per assigned seat/month (q2)
Replit- Starter (free of charge)
USD 0 (Starter Plan documentation; no longer listed as a separate plan on the pricing page)
- Core
20 USD per month or 18 USD per month with annual payment (pricing page; prices plus taxes depending on location). Included: 20 USD credits per month; additional usage is billed under Effort-Based Pricing (pay-as-you-go) or covered by credit packs; budgets can be set as a hard cap (pricing page, FAQ).
- Pro
100 USD per month or 90 USD per month with annual payment (pricing page; plus taxes depending on location). The pricing page shows further Pro tiers at 225, 440, 850 and 2,050 USD per month (with annual payment 215, 425, 825 and 2,000 USD per month); monthly credits according to the FAQ 'starting at $100 for Pro'. Additional usage under Effort-Based Pricing (pay-as-you-go) or via credit packs; budgets can be set as a hard cap.
- Enterprise
Individual (pricing page: 'Custom')
- Free
- GitHub Copilotyesall 7 plans
- Replityesall 4 plans
- GitHub Copilot
- Free
yes (limited: according to q2, an allowance of GitHub AI Credits, automatic model selection; according to q1, 2000 completions and 50 chat requests)
- Student
yes (allowance of GitHub AI Credits, automatic model selection, without third-party agents; q2)
- Pro
yes (base 1,000 AI Credits; q2)
- Pro+
yes (base 3,900 AI Credits, access to premium models; q2)
- Max
yes (base 10,000 AI Credits, priority access to premium models; q2)
- Business
yes (1,900 AI Credits per user/month, access to premium models; q2)
- Enterprise
yes (3,900 AI Credits per user/month, priority access to premium models; q2; requires GitHub Enterprise Cloud)
Replit- Starter (free of charge)
yes (daily Agent credits up to a monthly limit, Lite Build, Design Canvas; no Full Build, no Plan Mode, no AI integrations)
- Core
yes (Replit Agent, AI integrations, Plan Mode; USD 20 credit for more powerful models)
- Pro
yes (10 parallel Agents, USD 100 credit for the most powerful models, up to 15 collaborators, premium support)
- Enterprise
yes (SSO/SAML, advanced privacy controls, single-tenant environments, static egress IPs)
- Free
Evidence
- GitHub Copilot13 sources
- Replit12 sources
- GitHub Copilot
- GitHub Copilot: Plans & pricing incl. FAQ (Privacy, Retention, Training)Pricing page / provider FAQ, retrieved 18 Oct 2026
- Plans for GitHub Copilot (GitHub Docs)Official documentation, retrieved 14 Oct 2026
- Hosting of models for GitHub Copilot (GitHub Docs)Official documentation, retrieved 18 Oct 2026
- GitHub SubprocessorsSub-processor list, retrieved 14 Oct 2026
- About storage of your data with data residency (GHE.com)Official documentation, retrieved 14 Oct 2026
- GitHub Copilot with data residencyOfficial documentation, retrieved 14 Oct 2026
- About GitHub Enterprise Cloud with data residencyOfficial documentation, retrieved 14 Oct 2026
- Resources for getting approval of GitHub CopilotOfficial documentation, retrieved 14 Oct 2026
- GitHub General Privacy Statement (effective 2026-04-27)Privacy notices, retrieved 14 Oct 2026
- GitHub Data Protection Agreement (DPA), version October 2025DPA, retrieved 14 Oct 2026
- Managing GitHub Copilot policies as an individual subscriber (GitHub Docs)Documentation, retrieved 18 Oct 2026
- GitHub Copilot Trust Center: FAQ (Privacy, Security, Commercial)Trust Center / provider FAQ, retrieved 18 Oct 2026
- Access GitHub Copilot for free as a student (GitHub Docs)Official documentation, retrieved 18 Oct 2026
Replit- PricingPricing page, retrieved 18 Oct 2026
- SecurityTrust Center, retrieved 14 Oct 2026
- Privacy Policy (as of 2026-08-03)Privacy notice, retrieved 14 Oct 2026
- Data Processing Agreement (as of 2026-04-01)DPA, retrieved 18 Oct 2026
- Subprocessors (as of August 2026)Sub-processor list, retrieved 14 Oct 2026
- Terms of Service (as of 2026-08-03)Terms and conditions, retrieved 18 Oct 2026
- Docs: Model improvementDocumentation, retrieved 18 Oct 2026
- Docs: Starter PlanDocumentation, retrieved 14 Oct 2026
- Docs: GeographyDocumentation, retrieved 18 Oct 2026
- Replit's Trust CenterTrust Center, retrieved 18 Oct 2026
- Docs: Account InactivityDocumentation, retrieved 18 Oct 2026
- Docs: Deleting your dataDocumentation, retrieved 18 Oct 2026
not documentedmeans: not publicly documented, not verifiable in any provider source. It does not mean “no”.
No guarantee of accuracy, not legal advice. Each entry is valid as of the date shown. Open points are listed on the detail pages.
More comparisons
GitHub Copilot compared with
Individual pages: GitHub Copilot, Replit. All tools in the category: Software development.