GitHub
Developer platform · github.com · last read 2026-11-09
At a glance
- Is GitHub GDPR compliant?
- No tool is GDPR compliant on its own: compliance depends on what you process with it and how. What follows is what GitHub itself publishes, each answer linked to its source and the date we read it.
- Does GitHub have a data processing agreement (DPA)?
- Yes. GitHub publishes a data processing agreement at github.com. It gives 30 days' notice before a new subprocessor is added. It promises breach notification "without undue delay", with no number of hours. Source and date
- Which version of the GitHub DPA is current?
- On 2026-11-09, GitHub's DPA at github.com printed “Version: October 2025”. Source and date
- Does GitHub have a SOC 2 report?
- GitHub says a SOC 2 Type 2 report is available on request. We read this on 2026-11-09. Source and date
- Is GitHub ISO 27001 certified?
- GitHub states ISO/IEC 27001 certification (2022 edition, as GitHub names it), and says the certificate or audit report is available on request. We read this on 2026-11-09. Source and date
- Where is GitHub's trust center?
- GitHub publishes a page it calls “Trust Center” at github.com/trust-center. Its front page shows no request or sign-in step; documents further in may still have one. We read it on 2026-11-03. Source and date
- Does GitHub use your data to train AI models?
- For consumer plans (Copilot Free, Copilot Pro, Copilot Pro+, and Copilot Max): Interaction data (prompts, suggestions, code snippets) may be used to train and improve AI models; individual subscribers can opt out. For business plans (Copilot Business and Copilot Enterprise): Customer data not used to train AI models. Source and date
- Does GitHub offer zero data retention?
- For every plan (GitHub Copilot): Zero data retention agreements with model providers (OpenAI, Anthropic for generally available features; Claude Fable models excluded by default). Source and date
- How does GitHub transfer personal data out of the EU?
- GitHub's agreement relies on the EU standard contractual clauses, the EU-U.S. Data Privacy Framework and the UK transfer addendum. GitHub is on the official Data Privacy Framework List (status: Active). Source and date
- Does GitHub offer EU data residency?
- An EU location exists but only on the enterprise tier. Plan it needs: GitHub Enterprise Cloud with data residency. Source and date
- Does GitHub's EU region follow Microsoft's EU Data Boundary?
- GitHub's changelog of 2026-03-31 says: The EU region of GitHub Enterprise Cloud on ghe.com includes Azure infrastructure in Norway and Switzerland, besides EU member states. To align GitHub's EU region with Microsoft's EU Data Boundary. Source and date
- Who are GitHub's subprocessors?
- GitHub lists 25 third-party subprocessors; 25 of them name at least one processing country outside the EEA. We last read the list on 2026-10-05. Source and date
- How do you report a security vulnerability to GitHub?
- GitHub publishes a security.txt at github.com naming https://hackerone.com/github. Source and date
The same questions for any vendor, and the rule behind each: the vendor due diligence checklist.
Identity
| Legal entity | GitHub, Inc. |
|---|---|
| HQ | US |
| Parent company | MICROSOFT CORPORATION |
| Ultimate ownership | US |
| EU contracting entity | — |
| LEI | 6354003LMZZAKOPXLX69 |
| US CLOUD Act reach | Contracting entity incorporated in the US |
| Source | docs.github.com · 2026-10-08 |
Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.
GitHub data residency
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | Enterprise only | GitHub Enterprise Cloud with data residency | docs.github.com | 2026-09-18 |
EU: CORRECTION of our 2026-09-18 reading of unstated from the subprocessor page. Page states GitHub stores GitHub.com data in the USA by default, and that choosing where code and data are stored requires GitHub Enterprise Cloud with data residency, hosted on a dedicated GHE.com subdomain.
The same question for every vendor: where SaaS vendors store EU data.
GitHub's subprocessor list names AWS, Microsoft, Google and Oracle for hosting or infrastructure. Which SaaS vendors run on which cloud, and the sovereign offerings of each: sovereign clouds.
EU region and the EU Data Boundary
GitHub's changelog entry of 2026-03-31 ties the EU region of GitHub Enterprise Cloud with data residency to Microsoft's EU Data Boundary. What the boundary covers, in Microsoft's words: Microsoft's EU Data Boundary. The plan it needs is in the table above.
3 statements · all read 2026-11-03
| Topic | What the page says |
|---|---|
| From 1 May 2026 | The EU region of GitHub Enterprise Cloud on ghe.com includes Azure infrastructure in Norway and Switzerland, besides EU member states.QuoteStarting May 1, 2026, the EU data residency region for GitHub Enterprise Cloud on ghe.com will include Azure infrastructure in EFTA (European Free Trade Association) countries—specifically Norway and Switzerland—in addition to existing EU member state locations. |
| Why | To align GitHub's EU region with Microsoft's EU Data Boundary.QuoteThis aligns GitHub’s EU data residency boundaries with Microsoft’s EU Data Boundary, which covers both EU and EFTA member states. |
| Where | Azure regions in Norway and Switzerland, and the existing EU regions: France, Sweden, Germany, Netherlands.QuoteData for EU-region enterprises may be stored and processed in Azure regions in Norway and Switzerland, in addition to existing EU member state regions (i.e., France, Sweden, Germany, Netherlands). |
Source: github.blog/changelog/2026-03-31-eu-data-residency-region-expanding-to-include-efta-countries/.
Subprocessor chain
25 third parties · 7 of the vendor's own group companies · 25 with a country outside the EEA · all read 2026-10-05
| Subprocessor | Country | Purpose |
|---|---|---|
| Amazon Web Services Inc (AWS) | US | Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services |
| Anthropic PBC | US | AI Inference and AI Services |
| Cerebras Systems Inc. | US | AI Inference and AI Services |
| Cloudflare | US | Content delivery service |
| DataDome Solutions, Inc. | US, FR | Security management |
| Elasticsearch, Inc. | US | Cloud Hosted Infrastructure |
| Fastly | US | Content delivery service |
| Fireworks AI | US, DE, IS | AI Inference and AI Services |
| FullStory, Inc. | US | Customer support ticketing analysis |
| Google Cloud Platform (GCP) | US, BE, SG | Cloud Hosted Infrastructure, AI Inference and AI Services |
| Hewlett-Packard Limited | US | Cloud Hosted Infrastructure |
| LambdaTest | US | Cloud Hosted Infrastructure |
| Microsoft | US, AU, BR, CA, FR, JP, NO, ES, SE, CH, GB | Technical Services |
| Microsoft (Azure) | US, CA, CL, MX | Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services |
| Microsoft (Azure) | US | Cognitive Services and customer support ticketing analysis |
| Moveworks | US | Customer support ticketing analysis |
| NexMo Inc (aka Vonage) | US | SMS notification provider for 2 Factor Authentication |
| Obsidian Security | US | Security management |
| OpenAI | US | AI Inference and AI Services |
| Oracle America, Inc. | US | Cloud Hosted Infrastructure |
| Pusher | US | Building and managing real-time infrastructure for web and mobile applications |
| Tines Automation Inc. | US | Security management |
| Twilio (SendGrid) | US | SMS notification provider for 2 Factor Authentication |
| xAI | US | AI Inference and AI Services |
| Zendesk | US | Customer support ticketing system |
GitHub's own group companies listed as subprocessors (7)
| Company | Country | Purpose |
|---|---|---|
| GitHub Australia Pty Ltd | AU | GitHub Subsidiary |
| GitHub BV | NL | GitHub Subsidiary |
| GitHub Canada ULC | CA | GitHub Subsidiary |
| GitHub Germany GmbH | DE | GitHub Subsidiary |
| GitHub India Pty Ltd | IN | GitHub Subsidiary |
| npm Inc | US | GitHub Subsidiary |
| Semmle Inc | US | GitHub Subsidiary |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Every subprocessor in the registry, and which vendors name it: subprocessors.
Processing terms
From the vendor's data processing agreement · read 2026-10-21 · github.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | EU-U.S. DPF |
| Transfer mechanism | SCC module 1 |
| Transfer mechanism | SCC module 2 |
| Transfer mechanism | SCC module 3 |
| Transfer mechanism | Swiss FADP clauses |
| Transfer mechanism | UK Addendum |
| Notice of new subprocessors | 30 days before access to Customer Personal Data, by updating the Subprocessor List and giving notice via the means at https://gh.io/subscribe |
| If you object to one | May terminate the subscription for the affected Online Services without penalty by written notice before the notice period ends; if the service is part of a suite or bundle, termination applies to the entire suite or bundle |
| Obligations passed to subprocessors | Written agreements with Subprocessors compliant with GDPR requirements; GitHub responsible for and oversees Subprocessors' compliance |
| Breach notification | without undue delay |
| Deletion when the service ends | After completion of the Services, unless prohibited by law, deletes or returns all Customer Personal Data (at Customer's election) and deletes existing copies per GitHub's retention and deletion policy |
| Getting your data back | Customer may elect to have all Customer Personal Data returned following completion of the Services, unless prohibited by law |
| Requests from data subjects | redirects data subjects who contact GitHub to the Customer; cooperates and gives the Customer the necessary means to respond, consistent with the Online Services' functionality and GitHub's role |
| Audit | Third-party security reports (SOC1 Type 2, SOC2 Type 2, ISO 27001) on request; for regulator requests, access through an independent accredited third-party auditor during business hours, on 30 days' written notice, at customer's cost |
| Processing on your instructions | only acts on the data exporter's instructions and the Agreement, for Online Services and Professional Services |
| Confidentiality of staff | personnel must keep personal data confidential, and the obligation continues after their engagement ends |
| Security measures | appropriate technical and organizational measures and security safeguards as set out in Annex II to the Standard Contractual Clauses |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Which version applies
On 2026-11-09, the agreement printed: Version: October 2025
at github.com
Last updated 2025-10
This version is in our copies from 2026-10-21.
These terms side by side for every vendor: data processing agreements compared. What vendors give you for a transfer impact assessment: transfer impact assessments.
AI and your data
What GitHub's own pages state about the data you send its AI products, plan by plan. Compared with other vendors on AI vendors and your data.
| Plans | Term | What the page says | Source | Observed |
|---|---|---|---|---|
| All plans GitHub Copilot | Zero data retention | With its model providers Zero data retention agreements with model providers (OpenAI, Anthropic for generally available features; Claude Fable models excluded by default) | docs.github.com | 2026-10-28 |
| All plans GitHub Copilot | Model providers | Amazon Web Services | docs.github.com | 2026-10-28 |
| All plans GitHub Copilot | Model providers | Anthropic PBC | docs.github.com | 2026-10-28 |
| All plans GitHub Copilot | Model providers | Fireworks AI | docs.github.com | 2026-10-28 |
| All plans GitHub Copilot | Model providers | Google Cloud Platform | docs.github.com | 2026-10-28 |
| All plans GitHub Copilot | Model providers | Microsoft Azure AI Foundry | docs.github.com | 2026-10-28 |
| All plans GitHub Copilot | Model providers | OpenAI | docs.github.com | 2026-10-28 |
| All plans GitHub Copilot | Model providers | xAI | docs.github.com | 2026-10-28 |
| Consumer Copilot Free, Copilot Pro, Copilot Pro+, and Copilot Max | Training on your data | Used unless you opt out Interaction data (prompts, suggestions, code snippets) may be used to train and improve AI models; individual subscribers can opt out | docs.github.com | 2026-10-28 |
| Business Copilot Business and Copilot Enterprise | Training on your data | Not used Customer data not used to train AI models | docs.github.com | 2026-10-28 |
Assurance
Does GitHub have a SOC 2 report?
GitHub says a SOC 2 Type 2 report is available on request. We read this on 2026-11-09.
- Claimed “GitHub’s API stays secure with ISO, SOC 2, and GDPR.”
Source: github.com, 2026-11-09
Of the 114 vendors in this registry whose own pages mention SOC 2, 57 say the report is available on request, 1 links to the report itself, and 56 state it without saying how to get it. The type is the one the vendor names.
Is GitHub ISO 27001 certified?
GitHub states ISO/IEC 27001 certification (2022 edition, as GitHub names it), and says the certificate or audit report is available on request. We read this on 2026-11-09.
- Available on request “ISO/IEC 27001:2022 certification”
Source: docs.github.com, 2026-11-09
Of the 122 vendors in this registry whose own pages state ISO/IEC 27001, 16 link to the certificate, 43 say it is available on request, and 63 state it without saying how to get it. A certificate names the certification body, the scope and the expiry date: those are the three things to check.
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| Cloud Security Alliance CAIQ self-assessment (CSA CAIQ - Level 1) · CAIQ | Available on request | Level 1 | docs.github.com | 2026-11-09 |
| Cloud Security Alliance STAR certification (CSA STAR - Level 2) · CSA | Available on request | Level 2 | docs.github.com | 2026-11-09 |
| GDPR | Claimed | GitHub’s API | github.com | 2026-11-09 |
| ISO/IEC 27001:2022 · ISO27001 | Available on request | — | docs.github.com | 2026-11-09 |
| ISO | Claimed | GitHub’s API | github.com | 2026-11-09 |
| PCI DSS Attestation of Compliance · PCIDSS | Available on request | — | docs.github.com | 2026-11-09 |
| SOC 1, Type 2 · SOC1 | Available on request | — | docs.github.com | 2026-11-09 |
| SOC 2 · SOC2 | Claimed | GitHub’s API | github.com | 2026-11-09 |
| SOC 2, Type 2 · SOC2T2 | Available on request | — | docs.github.com | 2026-11-09 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
SecNumCloud, C5, ENS and HDS for every vendor, with the pages for ISO standards, SOC 2 and TISAX: certifications compared.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · GitHub | Active | non-HR data | 2027-08-03 | 2026-10-05 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · GitHub | Active | non-HR data | 2027-08-03 | 2026-10-05 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · GitHub | Active | non-HR data | 2027-08-03 | 2026-10-05 |
| FedRAMP Marketplace (US) | GitHub Enterprise Cloud · GitHub | FedRAMP Authorized | LI-SaaS | — | 2026-10-04 |
| Global LEI Index (GLEIF) | GITHUB INC · GITHUB INC | ISSUED | US-DE | 2027-03-06 | 2026-10-08 |
- ACN qualified cloud (Italy): checked 2026-11-09, no entry under GitHub; GitHub, Inc.
- ISO 27001 on the basis of IT-Grundschutz (BSI, Germany): checked 2026-11-09, no entry under GitHub; GitHub, Inc.
- CISPE Data Protection Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under GitHub; GitHub, Inc.
- DORA critical ICT third-party providers (ESAs): checked 2026-11-09, no entry under GitHub; GitHub, Inc.
- Data Privacy Framework List (US): checked 2026-11-09, 3 entries under GitHub; GitHub, Inc.
- ENS certificates of conformity (CCN, Spain): checked 2026-11-09, no entry under GitHub; GitHub, Inc.
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under GitHub; GitHub, Inc.
- FedRAMP Marketplace (US): checked 2026-11-09, 1 entry under GitHub; GitHub, Inc.
- GPAI Code of Practice signatories (European Commission): checked 2026-11-09, no entry under GitHub; GitHub, Inc.
- SecNumCloud qualified services (ANSSI, France): checked 2026-11-09, no entry under GitHub; GitHub, Inc.
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
What an entry on the Data Privacy Framework List covers, and which vendors hold one: EU-US Data Privacy Framework.
Support window
| Product | Support period | State | SBOM | Source | Observed |
|---|---|---|---|---|---|
| GitHub Enterprise Server | 2027-09-08 | Declared | unknown | docs.github.com | 2026-10-11 |
Vulnerability reporting: hackerone.com (security.txt, expires 2026-12-02; read 2026-11-02)
How other vendors publish theirs: security.txt across the registry.
Documents
Where is GitHub's trust center?
GitHub publishes a page it calls “Trust Center” at github.com/trust-center. Its front page shows no request or sign-in step; documents further in may still have one. We read it on 2026-11-03. Open github.com/trust-center
- Name “GITHUB TRUST CENTER”
Source: github.com, 2026-11-03. Read from the page's text, without a model; every vendor's trust center.
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| ai | Public | full | 200 | 2026-10-28 |
| certifications | Public | full | 200 | 2026-11-09 |
| certifications-2 | Public | full | 200 | 2026-11-09 |
| dpa | Public | full | 200 | 2026-10-21 |
| lifecycle | Public | full | 200 | 2026-10-11 |
| subprocessors | Public | full | 200 | 2026-09-18 |
History
| Detected | What moved | Why | Source |
|---|---|---|---|
| 2026-09-18 | EU data location Not stated → Enterprise only Minimum plan set to GitHub Enterprise Cloud with data residency Note rewritten | we read a better page | docs.github.com |
Every reviewed change across the registry, newest first: vendor changes.