Does GitHub Copilot Business / Enterprise train on your data?
Doesn't train by default
Doesn't train on business data by default.
"GitHub does not use either Copilot Business or Enterprise data to train its models." (Individual Free/Pro/Pro+ plans train by default since Apr 2026 unless opted out.)
Why this matters: A "no" keeps your prompts and files out of GitHub (Microsoft)'s models, where they couldn't be removed later. Confirm it covers the plan you use. Why training matters →
Below: retention, SOC 2, ISO 27001/42001, DPA, BAA, data residency and zero-retention for GitHub Copilot Business / Enterprise, each linked to GitHub (Microsoft)'s own page.
Trains on your data by default
"GitHub does not use either Copilot Business or Enterprise data to train its models." (Individual Free/Pro/Pro+ plans train by default since Apr 2026 unless opted out.)
- github.com/features/copilot/copilot-business · checked Oct 17, 2026
Data retention
Model-provider ZDR described; GitHub-side retention not stated on pages checked.
- docs.github.com/en/enterprise-cloud@latest/copilot/reference/ai-models/model-hosting · checked Oct 17, 2026
- github.com/features/copilot/copilot-business · checked Oct 17, 2026
- github.com/trust-center · checked Oct 17, 2026
- copilot.github.trust.page · checked Oct 17, 2026
SOC 2 Type II
Copilot trust page: SOC 2 Type 2 report.
- copilot.github.trust.page · checked Oct 17, 2026
ISO/IEC 42001
ISO/IEC 42001:2023 listed.
- copilot.github.trust.page · checked Oct 17, 2026
DPA available
Not stated on the GitHub (Microsoft) pages we checked.
- docs.github.com/en/enterprise-cloud@latest/copilot/reference/ai-models/model-hosting · checked Oct 17, 2026
- github.com/features/copilot/copilot-business · checked Oct 17, 2026
- github.com/trust-center · checked Oct 17, 2026
- copilot.github.trust.page · checked Oct 17, 2026
BAA / HIPAA
Not stated on the GitHub (Microsoft) pages we checked.
- docs.github.com/en/enterprise-cloud@latest/copilot/reference/ai-models/model-hosting · checked Oct 17, 2026
- github.com/features/copilot/copilot-business · checked Oct 17, 2026
- github.com/trust-center · checked Oct 17, 2026
- copilot.github.trust.page · checked Oct 17, 2026
Data residency options
Not stated on the GitHub (Microsoft) pages we checked.
- docs.github.com/en/enterprise-cloud@latest/copilot/reference/ai-models/model-hosting · checked Oct 17, 2026
- github.com/features/copilot/copilot-business · checked Oct 17, 2026
- github.com/trust-center · checked Oct 17, 2026
- copilot.github.trust.page · checked Oct 17, 2026
Zero-retention option
GitHub holds ZDR agreements with OpenAI and Anthropic (some Anthropic models retain data by default; ZDR exemption through end of 2026).
- docs.github.com/en/enterprise-cloud@latest/copilot/reference/ai-models/model-hosting · checked Oct 17, 2026
Vendor pages we monitor for this tool
We save a fingerprint (SHA-256 of the page's visible text) on every check so we can spot when a vendor edits its terms.
| Page | Checked | Fingerprint |
|---|---|---|
| https://docs.github.com/en/enterprise-cloud@latest/copilot/reference/ai-models/model-hosting | Oct 17, 2026 | 1e2f1b389aa3… |
| https://github.com/features/copilot/copilot-business | Oct 17, 2026 | bf3b183c78e8… |
| https://github.com/trust-center | Oct 17, 2026 | 46029738e51d… |
| https://copilot.github.trust.page/ | Oct 17, 2026 | cc770d7a5c0f… |
Compare with
- Cursor (Teams / Enterprise) Not stated
- JetBrains AI Assistant Doesn't train
- Replit (Teams / Enterprise) Doesn't train
- Tabnine Enterprise Doesn't train
- Windsurf (Teams / Enterprise) Trains by default
See all Coding tools · Why AI training on your data matters · How we source and verify this