AI Vendor Security & Compliance Brief
GitHub Copilot
Independent due-diligence summary · every fact links to the vendor's official source
94/100
AI Governance Readiness
Enterprise-Ready
The vendor is rated Enterprise-Ready with a score of 94 out of 100. Strongest evidence includes confirmed SOC 2 Type 2 and ISO 27001 certifications, and a policy not to train on customer data under enterprise terms. A recent change involved the disclosure and fix of CVE-2026-45033, which the vendor has already addressed. The most useful next step for buyers is to confirm they are running a current version of the product to ensure all fixes are applied.
Summarized strictly from the source-cited facts below — no outside information. Verify each point against its linked source.
Readiness Breakdown deterministic · evidence-only
- Independent Certification SOC 2 / ISO certifications confirmed via the vendor's trust portal (ISO 27001, SOC2 TYPE2). Audit report available under NDA — standard enterprise practice.
- Vendor-Stated Compliance Vendor states (cited, not independently audited): BAA Available (HIPAA), GDPR, HIPAA, ISO 27001, SOC 2.
- Customer-Data Training Enterprise terms: does NOT train on customer data (consumer/free tiers may differ — see breakdown).
- Data Processing Agreement A Data Processing Agreement is published and tracked.
- Breach History No known breaches in Have I Been Pwned.
- Vulnerability Exposure No known CVEs against the mapped product identity.
- Email Spoofing Protection (DMARC) DMARC enforced — domain spoofing mitigated.
- Vulnerability Disclosure Policy Publishes a security.txt disclosure policy (RFC 9116).
- Web TLS Certificate Valid TLS certificate in place.
- Legal Transparency 7 legal/policy documents publicly tracked.
Score is normalized over assessed components only — “unknown” items
are shown but never silently counted against the vendor.
Compliance Posture vendor-stated · cited
| Framework | Status | Source |
|---|---|---|
| GDPR | Stated by vendor | https://docs.github.com/en/site-policy/privacy-policies |
| ISO 27001 | Stated by vendor | https://github.com/security |
| SOC 2 | Stated by vendor | https://github.com/security |
| HIPAA | Not publicly verified | — |
| BAA Available (HIPAA) | Not publicly verified | — |
As published on the vendor's own trust/compliance pages — not independently audited. Independently verified attestations, when available, appear in the certifications section below. Request the underlying report before relying on these.
Data & Contract Facts deterministic · cited
| Attribute | Value | Source |
|---|---|---|
| Sub-processors (published list) | View document → | https://docs.github.com/en/site-policy/privacy-policies/github-subprocessors-and-cookies |
| Trains on Customer Data key clause |
Free / Pro:
trains on data
Copilot Free/Pro/Pro+: interaction data may be used to train models unless you opt out (policy updated April 2026).
cited →
Enterprise:
does not train
Copilot Business/Enterprise: interaction data is contractually exempt from model training.
cited →
|
see per-tier citations |
Security Posture authoritative · cited
Known Vulnerabilities (CVE / CISA KEV)
No open vulnerabilities
All known vulnerabilities have been patched by the vendor.
Vulnerability Disclosure Policy (security.txt)
Found
1
Email Spoofing Protection (DMARC)
Protected
DMARC enforced and SPF present — spoofing well mitigated.
Web TLS Certificate
Valid
Data Breach History
None found
Queried the authoritative source; no records.
Supply-Chain Security (OpenSSF Scorecard)
Not applicable
Closed-source service — no public source repository; OpenSSF Scorecard (open-source supply-chain) does not apply.
OFAC Sanctions Screening
None found
Queried the authoritative source; no records.
SEC Cyber Incident Disclosures (8-K 1.05)
Found
1
Historical disclosure — likely remediated; verify current status.
Security & Compliance Timeline authoritative · dated
Dated, source-cited history from authoritative records (NVD, SEC, CISA KEV). Subscribe to get alerted the moment a new event lands.
- 2024-01-19 SEC 8-K Material cybersecurity incident disclosed to SEC by MICROSOFT CORP
Certifications Available Under NDA / Trust Center attested · report gated
| Certification | Status | Trust Center |
|---|---|---|
| ISO 27001 | Available via Trust Center | https://github.com/security |
| SOC2 TYPE2 | Available via Trust Center | https://github.com/security |
An independent audit report exists but is gated behind an NDA or trust-center registration. Request it directly via the vendor's trust center. These count as partial assurance — stronger than a vendor claim, but not an open third-party attestation.
Common compliance questions
Is GitHub Copilot SOC 2 compliant?
Is GitHub Copilot ISO 27001 compliant?
Is GitHub Copilot GDPR compliant?
Is GitHub Copilot HIPAA compliant?
Does GitHub Copilot train on your data?
Each answer is grounded in the cited evidence above — with an honest "no evidence on file" where nothing is published.
Tracked Legal & Policy Documents
How to Obtain Non-Public Documents
These documents were not found at a public URL — which is normal. Many are provided on request, only on enterprise plans, or via the vendor's trust portal. Here is where each lives and what to do to get it.
| Document | Availability | How to obtain |
|---|---|---|
| Business Associate Agreement (BAA) | On request (HIPAA only) | A BAA is required only when processing PHI under HIPAA and is almost never published publicly. Request one from the vendor's compliance/legal team during enterprise onboarding — it is typically signed under NDA. Trust center → |
| Master Services Agreement (MSA) | Negotiated per contract | The MSA governs enterprise contracts and is negotiated per deal, so there is usually no public link. Self-serve plans are covered by the public Terms of Service instead; for an MSA, ask the vendor's sales team during procurement. Trust center → |
| Service Level Agreement (SLA) | Enterprise tier | A formal uptime/support SLA is generally offered only on enterprise/paid plans and attached to the order form. Ask sales for the SLA exhibit or check the enterprise pricing page; the trust center often summarises uptime commitments. Trust center → |
Continuous Monitoring change-tracking active
5 legal & policy documents under change-monitoring since 2026-05-31. 6 tracked changes detected since baseline.
Ai PolicyDpaPrivacySubprocessorsTos
| Detected | Change | Detail |
|---|---|---|
| 2026-06-17 | CVE / Security Incident |
1 new CVE (published from 2026-05-13): CVE-2026-45033. A fix is available from the vendor for all of these.
What this means: Disclosed and already fixed by the vendor — no action needed beyond confirming you run a current version. Tracked as part of the vendor's security-response cadence, not an active exposure.
|
| 2026-06-17 | ToS Clause Change |
The Privacy Policy changed — 1 removed passage. Review the current version.
What this means: The Privacy Policy text changed, but the edit doesn't clearly touch a tracked legal concern (it may be a heading, formatting, or minor wording change) — skim the current Privacy Policy to confirm.
Show exact changed textIn plain terms — verify against the exact changed text below: The text "GitHub General Privacy Statement - GitHub Docs" and "Skip to main content" were removed. @@ -1,4 +1,2 @@-GitHub General Privacy Statement - GitHub Docs -Skip to main content GitHub General Privacy Statement In this article |
| 2026-06-16 | CVE / Security Incident |
1 new CVE (published from 2026-05-13): CVE-2026-45033. A fix is available from the vendor for all of these.
What this means: Disclosed and already fixed by the vendor — no action needed beyond confirming you run a current version. Tracked as part of the vendor's security-response cadence, not an active exposure.
|
| 2026-06-15 | CVE / Security Incident |
1 new CVE (published from 2026-05-13): CVE-2026-45033. A fix is available from the vendor for all of these.
What this means: Disclosed and already fixed by the vendor — no action needed beyond confirming you run a current version. Tracked as part of the vendor's security-response cadence, not an active exposure.
|
| 2026-06-15 | ToS Clause Change |
The Privacy Policy changed — 1 removed passage. Review the current version.
What this means: The Privacy Policy text changed, but the edit doesn't clearly touch a tracked legal concern (it may be a heading, formatting, or minor wording change) — skim the current Privacy Policy to confirm.
Show exact changed textIn plain terms — verify against the exact changed text below: The text "GitHub General Privacy Statement" and "In this article" were removed from the document. @@ -1,4 +1,2 @@-GitHub General Privacy Statement -In this article GitHub Privacy Statement Welcome to the GitHub Privacy Statement. This is where we describe how we handle your “Personal Data”, which is information that is directly linked or can be linked to you. It applies to the Personal Data that GitHub, Inc. or GitHub B.V., processes as the “Data Controller” when you interact with websites, applications, and services that display this Statement (collectively, “Services”). This Statement does not apply to services or products that do not display this Statement, such as Previews, where relevant. |
Search the Legal Documents verbatim · cited
Search GitHub Copilot's captured Terms, DPA, Privacy Policy and sub-processor list. Results are the exact clauses from the source documents, each with a link to where it lives. No summary, no interpretation — just the wording on the record. If nothing matches, we say so rather than guess.
Every result is a verbatim clause pulled straight from the linked source document — nothing is paraphrased or generated.
Monitor GitHub Copilot — get alerted when this changes
This brief is a point-in-time snapshot. Vendors quietly revise their DPA, sub-processors, certifications and security posture — and disclose new CVEs. Get a priority email the moment GitHub Copilot changes something that affects your risk. Built for procurement & security teams.
Free. One email per material change. Unsubscribe anytime. No sales spam.
Every data point above is extracted from the vendor's own official trust, security, or legal
pages and links to its source. This brief contains no scraped sentiment, forum chatter, or
AI-inferred opinion — only verifiable, deterministic facts. Verify each source before
procurement decisions.