GitHub Copilot safety profile

What it does with your data

It depends on the plan. On Copilot Free, Pro, Pro+ and Max, starting April 24, 2026, GitHub may use interaction data to train its AI models unless the user opts out. That covers prompts, Copilot’s answers, code snippets and the surrounding context. Training data can be shared with GitHub affiliates, including Microsoft, but not with outside AI model providers. People who already opted out of the older product-improvement setting keep that choice.

On Copilot Business and Copilot Enterprise, GitHub says it does not train on customer data. Its Data Protection Agreement forbids that without the customer’s permission.

For Business and Enterprise, chat in the code editor, code completions and the command-line tool keep no inputs or outputs by default. GitHub makes an exception for limited retention to investigate confirmed violations or for security. Other Copilot use keeps inputs and outputs for up to 28 days. Engagement data is kept for 2 years. The pages checked do not state retention for Free, Pro or Pro+.

Settings to change first

If anyone at your organization uses an individual plan (Free, Pro, Pro+ or Max), turn off training before they use Copilot for work:

1. Click your profile picture, then Copilot settings.
2. Select the “Allow GitHub to use my data for AI model training” dropdown.
3. Click Disabled.

GitHub says opting out does not affect access to Copilot features.

On a Copilot Business or Copilot Enterprise license, this setting does not appear, because that data is already excluded from training. If a colleague says they cannot find it, check which license they have. On those plans, the settings that matter are the admin policies described below.

Free and paid tiers

The training change applies to Copilot Free, Pro and Pro+, and GitHub’s own help pages include Max as well. Business and Enterprise users are not affected.

The legal footing also differs. On Business and Enterprise, GitHub acts mainly as a data processor under the Data Protection Agreement, which means it handles data on your organization’s behalf. On Free and Pro, GitHub acts as a data controller, and the GitHub Terms of Service and General Privacy Statement apply.

There is one useful exception for individual plans. GitHub does not train on content from any paid organization’s repositories, even when someone works there on a Free, Pro, Pro+ or Max plan. When a person is added to a Business or Enterprise plan, their individual plan is cancelled.

Admin controls

Admin controls come with Copilot Business and Copilot Enterprise. Admins set Copilot policies on the enterprise’s AI controls tab or in organization settings. These policies decide which features, agents and models staff can use. An enterprise admin can turn a policy on, turn it off, or let each organization decide. Two policies set whether new features and models start out on or off.

Admins can review policy changes in the audit log and hand off this work to someone else using a custom role.

On certifications, GitHub publishes a SOC 2 Type I report for Copilot Business. Business and Enterprise are covered by its latest SOC 2 Type 2 and its ISO 27001 certificate.

Using it with donor and client data

Copilot writes and explains code, so most staff should never need donor records in it. Still, people often paste a spreadsheet row or a database export to ask for help. Plan for that.

• Use Copilot Business or Copilot Enterprise for any work on systems that hold donor or client data.
• If someone must use an individual plan, have them set the training dropdown to Disabled first.
• Never paste donor names with gift amounts, client case notes, health details or payment details into a prompt. Use made-up sample rows instead.

GitHub’s FAQ has a question about whether it trains on individual data, but the answer only covers Business and Enterprise. Retention for Free, Pro and Pro+ is not documented in the pages checked. If you allow individual plans, ask GitHub to confirm both points in writing.

Questions people ask

Does GitHub train on my code if I use the free plan?

It may. From April 24, 2026, GitHub may use Free plan prompts, answers and code snippets for training unless you opt out. Code in a paid organization’s repositories is excluded.

Will turning off training make Copilot work worse?

GitHub says opting out does not affect your access to Copilot features. You keep the same tools.

Where is our data processed?

Copilot sends data to GitHub’s Azure tenant or another model provider. For agentic features, data stays in-region only with GitHub Enterprise Cloud with data residency. Otherwise it may be processed anywhere in the world.