Software development

GitHub Copilot

GitHub Copilot (Free / Student / Pro / Pro+ / Max / Business / Enterprise)

Provider: GitHub, Inc. · Based in: According to the GitHub General Privacy Statement · Provider website

Plans
7
Sources
18
As of
18 Oct

As of 18 Oct 2026. Based on our research on this date and the process described in the methodology. No guarantee of accuracy, not legal advice. The provider’s current documents take precedence. Found an error? Report a correction.

Incomplete. 5 points could not be verified in any provider source (see open points). This does not mean the matter is unproblematic; it means we have not checked it.

At a glance

Hosting
mixed: Free, Student, Pro, Pro+, MaxEU option: Business, Enterprise
Training on inputs
opt-out available: Free, Pro, Pro+, Maxnot publicly documented: Studentno: Business, Enterprise
DPA
not publicly documented: Free, Student, Pro, Pro+, Maxyes: Business, Enterprise
Provider
GitHub, Inc. (subsidiary of Microsoft)
Based in
According to the GitHub General Privacy Statement (effective 2026-04-27, q11): GitHub, Inc., 88 Colin P. Kelly Jr. St., San Francisco, CA 94107, USA; GitHub B.V., Prins Bernhardplein 200, 1097JB Amsterdam, Netherlands (both as controllers depending on the processing). DPA contracting party: GitHub, Inc. (q13).

Values from 7 plans, each listed with the plans it applies to. Details and evidence are in the plan table.

Compare GitHub Copilot

Compare with another tool

Compared plan by plan with other tools in the category Software development:

Details per plan

Short values per plan. Click a feature to open the evidence and notes for all plans; sources with retrieval dates are under “Evidence”.

Compare with another tool

Price and scope

differs by plan
0 USD
yes

Contract and data use

differs by plan
not publicly documented
differs by plan
opt-out available
differs by plan
not publicly documented

Hosting and sharing

differs by plan
mixed
list available

Evidence

differs by plan
7 sources

not documentedmeans: not publicly documented, not verifiable in any provider source. It does not mean “no”.

Third-country transfers

GitHub Data Protection Agreement (October 2025 version, q13): transfers to third countries without an adequacy decision take place "subject to GitHub's self-certification to the EU-US Data Privacy Framework and, as applicable, the UK Extension ... and/or the Swiss-US Data Privacy Framework; and/or ... through the Standard Contractual Clauses" (EU SCCs under Decision 2021/914, UK International Data Transfer Addendum); Dutch law and Dutch courts apply to the SCCs. Privacy Statement (q11): participation in the EU-U.S. DPF, UK Extension and Swiss-U.S. DPF; otherwise standard contractual clauses. GitHub.com stores data in the USA by default (q7). The sub-processor list names processing locations in the USA as well as in Canada, Chile, Mexico, Belgium, Germany, Iceland and Singapore (including Azure, GCP, Fireworks AI); most sub-processors have their registered office in the USA (q4). DPF List (q18, retrieved 2026-10-18): GitHub (San Francisco) active for the EU-U.S. DPF, the Swiss-U.S. DPF and the UK Extension (non-HR data).

Sources:

Certifications (as stated by the provider)

Copilot Trust Center (q15, retrieved 2026-10-18), Compliance section: SOC 1, SOC 2, SOC 3, ISO 27001:2013, CSA STAR Level 2, TISAX, ISO/IEC 42001:2023. FAQ (q16): "Copilot Business and Copilot Enterprise was included in our latest SOC 2 Type 2"; Copilot Business and Copilot Enterprise are within the scope of the ISO 27001 certificate. Announcement of 2026-03-25: ISO/IEC 42001:2023 is being extended "across the GitHub Copilot portfolio" (q15). Some reports only after an access request ("Request access"). According to GitHub Docs, SOC reports, SOC 3, CSA CAIQ (Level 1) and the ISO/IEC 27001:2022 certification are among the compliance reports available to organisations (q9). A certification scope for the individual plans (Free to Max) is not stated.

Sources:

AI Act

Functions: Code completion and Next Edit Suggestions in IDEs, Copilot Chat (IDE, GitHub.com, Mobile, Windows Terminal), agents (Copilot cloud agent, agent mode), Copilot CLI, GitHub Copilot app, Code Review, Copilot Memory; model selection including OpenAI, Anthropic, Google, xAI and other models (q2, q3, q12).

Provider’s statement: not publicly documentedno express statement on the EU AI Act on the retrieved pages, including the Copilot Trust Center and its FAQ (q15, q16) and a search of GitHub Docs for "EU AI Act"; GitHub refers to the Microsoft Responsible AI Standard, q10

Classification (for review, not legal advice): For review: customer typically a deployer (Art. 3(4) AI Act) of an AI system; GitHub/Microsoft as provider. Review Art. 50 when publishing AI-generated content and transparency obligations towards users; assess agent functions (Cloud Agent, CLI) separately. Not legal advice.

Sources:

Current notes 2026

Since the switch to GitHub AI Credits, all plans include a monthly credit allowance; according to q1, code completions and Next Edit Suggestions do not consume credits (q1, q2). The Max plan (100 USD/month, 10,000 base credits) is listed (q2). Since 2026-04-24, GitHub may use interactions of users on the Free, Pro, Pro+ and Max plans for training unless they opt out (q14); according to q1, users were informed 30 days before the change. Copilot data residency in the EU and USA via GHE.com with a 10 % credit surcharge (q6). For Claude Fable 5 and 5.1, according to q3, Anthropic retains prompts and outputs by default for safety classifiers; Zero Data Retention is available on request until the end of 2026 under a temporary exception (q3). GitHub privacy statement effective since 2026-04-27 (q11). GitHub DPA in the October 2025 version (q13).

Open points of the review

  • Retention for individual plans (Free, Student, Pro, Pro+, Max): no period documented; the Copilot Trust Center FAQ only refers to the same "operational purposes" as for Business/Enterprise (q16).
  • Use for training for Copilot Student: neither GitHub Docs (q1, q3, q14, q17) nor the Copilot Trust Center FAQ (q16) expressly mention Student.
  • Hosting for individual plans only from the general privacy statement (region, USA, other countries); inference location for Business/Enterprise without the data residency policy only partially stated (q3, q4, q5).
  • Provider statement on the EU AI Act: found neither in GitHub Docs nor in the Copilot Trust Center.
  • GitHub Data Protection Agreement (q13, October 2025 version): specific erasure periods not stated (reference to an unpublished "retention and deletion policy"); Copilot is not expressly mentioned in the DPA, but the Copilot Trust Center FAQ assigns the data processing for Copilot Business/Enterprise to the DPA (q16).

Frequently asked questions

Where does GitHub Copilot store data?

mixed (plans: Free, Student, Pro, Pro+, Max); EU hosting selectable (plans: Business, Enterprise). According to the provider, as of 18 Oct 2026.

Is there a DPA for GitHub Copilot?

not publicly documented in: Free, Student, Pro, Pro+, Max; yes in: Business, Enterprise. Based on our research, as of 18 Oct 2026.

Does GitHub Copilot use inputs for AI training?

opt-out available in: Free, Pro, Pro+, Max; not publicly documented in: Student; no in: Business, Enterprise. Based on our research, as of 18 Oct 2026.

Where is the provider based?

According to the GitHub General Privacy Statement: GitHub, Inc., 88 Colin P. Kelly Jr. St., San Francisco, CA 94107, USA; GitHub B.V., Prins Bernhardplein 200, 1097JB Amsterdam, Netherlands (both as controllers depending on the processing). DPA contracting party: GitHub, Inc.. According to the provider, as of 18 Oct 2026.

All sources

  1. 01GitHub Copilot: Plans & pricing incl. FAQ (Privacy, Retention, Training)Pricing page / provider FAQ · retrieved 18 Oct 2026
  2. 02Plans for GitHub Copilot (GitHub Docs)Official documentation · retrieved 14 Oct 2026
  3. 03Hosting of models for GitHub Copilot (GitHub Docs)Official documentation · retrieved 18 Oct 2026
  4. 04GitHub SubprocessorsSub-processor list · retrieved 14 Oct 2026
  5. 05About storage of your data with data residency (GHE.com)Official documentation · retrieved 14 Oct 2026
  6. 06GitHub Copilot with data residencyOfficial documentation · retrieved 14 Oct 2026
  7. 07About GitHub Enterprise Cloud with data residencyOfficial documentation · retrieved 14 Oct 2026
  8. 08Resources for getting approval of GitHub CopilotOfficial documentation · retrieved 14 Oct 2026
  9. 09Accessing compliance reports for your organizationOfficial documentation (certifications) · retrieved 14 Oct 2026
  10. 10GitHub Trust Center (redirect from resources.github.com/copilot-trust-center)Trust Center (landing page) · retrieved 14 Oct 2026
  11. 11GitHub General Privacy Statement (effective 2026-04-27)Privacy notices · retrieved 14 Oct 2026
  12. 12Application card: GitHub Copilot inline suggestionsOfficial documentation · retrieved 14 Oct 2026
  13. 13GitHub Data Protection Agreement (DPA), version October 2025DPA · retrieved 14 Oct 2026
  14. 14Managing GitHub Copilot policies as an individual subscriber (GitHub Docs)Documentation · retrieved 18 Oct 2026
  15. 15GitHub Copilot Trust Center (compliance, resources, announcements)Trust Center · retrieved 18 Oct 2026
  16. 16GitHub Copilot Trust Center: FAQ (Privacy, Security, Commercial)Trust Center / provider FAQ · retrieved 18 Oct 2026
  17. 17Access GitHub Copilot for free as a student (GitHub Docs)Official documentation · retrieved 18 Oct 2026
  18. 18Data Privacy Framework List (entry GitHub)Official list · retrieved 18 Oct 2026

More tools in Software development with an EU hosting option (in at least one plan)

  • Amazon Q Developer · Based in: Depending on the account country: Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg
  • IONOS AI Model Hub · Based in: IONOS Cloud GmbH, Elgendorfer Straße 57, 56410 Montabaur, Germany
  • Lovable · Based in: Lovable Labs Sweden AB, Regeringsgatan 25, 111 53 Stockholm, Sweden
  • STACKIT AI · Based in: Schwarz Digits Cloud GmbH & Co. KG, Am Campus 1, 74177 Bad Friedrichshall, Germany

All tools in Software development · Tools with an EU hosting option

Further reading

All tools in the category: Software development. GitHub Copilot has at least one plan with an EU hosting option; see also AI tools with an EU hosting option. Figures across all tools: Data report.