GitHub AI Footnotes
What GitHub's AI features do with your data, as GitHub publishes it. Checked October 31, 2026. GitHub in the Directory.
Agent access
GitHub's own MCP server; the remote server hosted by GitHub is generally available, and it can also run locally. source, source 2, source 3 · checked October 31, 2026
Stage: generally available. Authentication: OAuth 2.1 with PKCE, or a personal access token
GitHub Copilot (chat, inline suggestions, Copilot CLI and the Copilot app)
Copilot Business and Copilot Enterprise
| On by default? | Not published as of October 31, 2026 |
|---|---|
| How an admin turns it off | Organization Settings > Copilot > Policies (features) and Models; enterprise policies override organization settings. source · checked October 31, 2026 |
| Trains on customer data? | GitHub does not use Copilot Business or Copilot Enterprise customer data to train AI models. source · checked October 31, 2026 |
| Retention | In the IDE, Copilot app and Copilot CLI, inputs and outputs are not retained by default for Business and Enterprise; GitHub may retain them for a limited period to investigate confirmed policy violations or protect the service. source · checked October 31, 2026 |
| Where data is processed | With GitHub Enterprise Cloud with data residency, a policy keeps Copilot inference processing and associated data in the designated region. source · checked October 31, 2026 |
| Model providers | Models from OpenAI, Anthropic, Google, xAI and Microsoft, and the open-weight Kimi K3 hosted on Fireworks AI; GitHub states third-party providers do not train on customer data or retain customer code, except that Anthropic retains prompts and outputs for Claude Fable 5 to run safety classifiers. source, source 2, source 3, source 4, source 5, source 6, source 7, source 8 · checked October 31, 2026 |
| Price | Per seat plus consumption: Copilot Business $19 USD and Copilot Enterprise $39 USD per granted seat per month, with 1,900 and 3,900 pooled AI credits per user; usage beyond the pool is $0.01 USD per AI credit. source · checked October 31, 2026 |
Copilot cloud agent (Copilot in the cloud)
Copilot Business and Copilot Enterprise
| On by default? | Enabled by default for organization members assigned a Copilot Business or Copilot Enterprise license. source · checked October 31, 2026 |
|---|---|
| How an admin turns it off | Copilot policies page: Copilot in the cloud policy; per repository: Organization Settings > Copilot > Cloud > Repository access. source · checked October 31, 2026 |
| Trains on customer data? | GitHub does not use Copilot Business or Copilot Enterprise customer data to train AI models. source · checked October 31, 2026 |
| Retention | For Copilot use outside the IDE, app and CLI, inputs and outputs are retained for the life of the account. source · checked October 31, 2026 |
| Where data is processed | With GitHub Enterprise Cloud with data residency, agent data stays in-region; on GitHub.com it may be processed anywhere. source · checked October 31, 2026 |
| Model providers | Not published as of October 31, 2026 |
| Price | Consumption in GitHub AI Credits, priced by model and tokens, at $0.01 USD per credit. source · checked October 31, 2026 |
Copilot code review
Copilot Business and Copilot Enterprise
| On by default? | Not published as of October 31, 2026 |
|---|---|
| How an admin turns it off | Organization Copilot policy settings: Copilot code review option. source · checked October 31, 2026 |
| Trains on customer data? | GitHub does not use Copilot Business or Copilot Enterprise customer data to train AI models. source · checked October 31, 2026 |
| Retention | Not published as of October 31, 2026 |
| Where data is processed | Not published as of October 31, 2026 |
| Model providers | Not published as of October 31, 2026 |
| Price | Consumption: AI credits for each review plus GitHub Actions minutes for agentic context gathering. source · checked October 31, 2026 |
Connections to outside MCP servers
Copilot connects to outside MCP servers in IDEs, Copilot CLI, the Copilot app and the cloud agent; for Copilot Business and Enterprise, the MCP servers in Copilot policy controls this, is disabled by default, and covers surfaces where MCP support is generally available. source, source 2, source 3 · checked October 31, 2026
Compliance
- FedRAMP: With GitHub Enterprise Cloud with data residency in the US, an enterprise policy (off by default, 10% more AI credits per request) restricts Copilot to models with FedRAMP Moderate certification; GitHub states the model hosts and infrastructure are FedRAMP Moderate authorized and that Copilot itself will become FedRAMP authorized as part of GHEC-DR's authorization path. source, source 2, source 3, source 4 · checked October 31, 2026
Not published by GitHub as of October 31, 2026
- EU AI Act statement for GitHub Copilot (GitHub is not listed separately on the European Commission's GPAI Code of Practice signatory list)
- FedRAMP authorization of GitHub Copilot itself (GitHub states it will follow GHEC-DR's authorization path)
- HIPAA BAA coverage of GitHub Copilot
- Default state of the Copilot code review policy for licensed users
- Retention period specific to Copilot code review
Changes
No changes recorded since the first check on October 31, 2026.
How this page is made, and how to send a correction: method.