GitHub Copilot for Business

1. Tool Overview

GitHub Copilot for Business is an AI-powered coding assistant (“AI pair programmer”) designed for organizations and enterprises. It integrates with developers’ code editors, IDEs, and the GitHub platform to suggest code snippets, functions, or entire lines based on context and natural language prompts【20†L519-L527】. The intended use is to boost developer productivity, improve code quality, and help automate routine coding tasks. Unlike the individual Copilot offering, Copilot for Business includes enterprise features such as seat licensing, organization-wide policy controls, and enhanced privacy safeguards【20†L499-L507】【20†L511-L515.

Official links: The service is described on GitHub’s website and documentation. Key references include the GitHub Copilot product page and the GitHub Docs (e.g. “What is GitHub Copilot?”【32†L348-L356】). GitHub’s own announcement blog post provides an overview of Copilot for Business features and pricing【20†L499-L507.

2. Privacy Settings

GitHub Copilot for Business offers several privacy-focused settings and controls to help organizations protect their code and data:

  • Public Code Filtering: Organizations can block suggestions that match public code on GitHub. When enabled, Copilot will check generated suggestions against a database of public GitHub code (about a 150-character window) and suppress any suggestion that is an exact or near match to existing public code【57†L322-L330】. This helps avoid unintentionally using copyrighted open-source code verbatim. If this filter is disabled (allowing public matches), users are able to see reference information for any suggestions that duplicate public code, including the source repository and license【21†L338-L347】.
  • Content Exclusions: Administrators can configure content exclusion rules to prevent Copilot from accessing or using specified files or paths within repositories【25†L294-L302】. Code in excluded files will not be used as context for suggestions, and Copilot will not offer completions inside those files【25†L295-L303】. This is useful for keeping sensitive code (such as secrets, credentials, or proprietary algorithms) out of Copilot’s prompt context. Repository owners or organization owners can set these exclusions at the repository or org level【25†L304-L312】.
  • Opt-Out of Data Collection: By default, Copilot for Business does not retain prompts or suggestions for product improvement – in fact, GitHub states that it “will not use your data, including prompts, suggestions, and code snippets, for AI model training”【22†L395-L399】. Individual users (for personal accounts) have a setting to allow or disallow their editor data being collected for improving Copilot, but for business accounts this data collection is off and cannot be enabled【22†L395-L399】. This means code fragments from your developers are not stored or used to train the AI when using the Business plan【20†L511-L515】. Likewise, telemetry is limited to necessary operational logs (see Data Management section), and organizations can enforce that no private code is shared outside the service.
  • Alternative AI Model Choice: Copilot for Business admins can control whether to use only the default GitHub Copilot model or allow third-party AI models that GitHub may offer. Currently, GitHub supports models from OpenAI, and is introducing others like Anthropic’s Claude and Google’s Gemini as optional alternatives【57†L312-L317】. If enabled, these alternatives would be used to generate suggestions (for example, in Copilot Chat), potentially sending code prompts to those providers. Organizations concerned with data exposure can disable use of non-GitHub models so that code stays within Microsoft/GitHub’s infrastructure【57†L312-L317】. All model requests, regardless of provider, are mediated through GitHub’s systems with the same encryption and policies (see Data in Transit/At Rest).
  • Admin-Enforced Settings: Organization owners can set and enforce policies for all users on the Copilot Business plan. For example, if the org enables public code filtering or disables alternate models, those settings apply to all members and cannot be overridden by individuals【21†L331-L339】【57†L332-L339】. This ensures consistent privacy standards across the team.

All these settings are accessible via the GitHub UI (Organization Settings > Copilot > Policies). They allow UK Government teams to tailor Copilot’s behavior to meet security requirements – e.g. disabling any suggestion sources or data sharing that conflict with departmental policy – while still benefiting from AI assistance.

3. Terms of Use and Privacy Policy

Terms of Use: GitHub Copilot for Business is subject to specific product terms in addition to GitHub’s general terms. For Copilot Business subscribers, the governing terms are the “GitHub Copilot Product Specific Terms.” These terms outline how Copilot may be used and any product-specific conditions【32†L332-L340】. Notable points include:

  • Ownership of Code: The code you write with Copilot’s help remains your property. Copilot’s suggestions (the AI-generated code completions) are provided for you to use at your discretion, and GitHub does not claim ownership of the suggestions【32†L348-L356】. Once you accept a suggestion and incorporate it into your code, it is treated as your code. (The terms clarify that uncommitted suggestions aren’t considered “Content” you uploaded to GitHub until you actually save/commit them【32†L348-L356】.)
  • Responsibility and IP Considerations: Users are responsible for how they use Copilot’s output. The terms advise having policies to prevent using suggestions that might violate third-party rights【32†L351-L358】. This is because in rare cases Copilot might produce code similar to existing public code (raising potential copyright issues). Importantly, GitHub offers intellectual property indemnification for Copilot for Business users in certain conditions: if a Copilot suggestion is claimed to infringe copyright and you had the public code filter enabled, GitHub (and Microsoft, if under a Microsoft agreement) will defend and indemnify the customer【12†L75-L83】. This indemnity is detailed in the enterprise agreements (such as the Microsoft Business and Services Agreement for customers under Microsoft licensing)【12†L77-L83】. UK Government users will appreciate this protection, as it reduces legal risk when using AI-generated code.
  • Acceptable Use: Copilot must be used in line with GitHub’s Acceptable Use Policies【32†L358-L364】. For example, users should not intentionally prompt Copilot with illegal or sensitive data that violates policies. (In a government context, this means users should avoid inputting classified or personal data into prompts.) If the organization chooses to allow suggestions that match public code, the users are expected to comply with any open-source licenses attached to that code【32†L360-L364】.
  • Third-Party Software and Extensions: If Copilot is used with any third-party extensions or integrations, those may have their own terms/privacy. The terms note that customizations or plugins for Copilot might be subject to separate terms【31†L29-L37】【31†L47-L55】, which is relevant if, for example, an organization builds an internal extension or uses Copilot with other tools.

Privacy Policy: The handling of personal data in Copilot is covered by the GitHub Privacy Statement (which is GitHub’s general privacy policy)【27†L43-L51】, as well as additional detail in the Copilot-specific Privacy FAQ and Trust Center. Key privacy points for Copilot for Business include:

  • Data Protection Agreement (DPA): For compliance with data protection laws like the UK GDPR and EU GDPR, GitHub offers a Data Protection Agreement. GitHub affirms that Copilot “supports compliance with the GDPR and similar legislation” and that customers can sign a DPA with GitHub【42†L1-L9】. UK government entities can use this to ensure appropriate safeguards (including standard contractual clauses for international data transfers) are in place.
  • Data Collection and Use: According to GitHub’s documentation, Copilot may collect certain usage data (telemetry) and process prompts and suggestions in order to provide the service【32†L368-L376】. However, for Copilot Business, no code or prompt data is used to train the AI model【29†L571-L574】. Any data collected is used for service delivery, troubleshooting, and product improvements within the scope of GitHub’s privacy statement and the customer’s settings【29†L579-L588】【29†L591-L599】. Copilot Business data is not fed back into the AI training pipeline, which is an important assurance for confidentiality.
  • Personal Data and Output: GitHub notes that Copilot is designed with privacy in mind but due to the nature of AI and broad training data, it cannot guarantee that no personal data will ever appear in suggestions【28†L655-L663】. The AI was trained on public repositories, and in testing it sometimes produced strings that looked like personal info (though typically not actual, and very rare). This is a reminder that users should still be cautious and review AI outputs, especially in a government context where personal data must be protected. The Privacy Statement also outlines how users can exercise rights (access, deletion) regarding any personal data processed via GitHub Copilot【28†L665-L672】.
  • Retention and Deletion: The terms and privacy documentation describe how long different types of Copilot data are retained (see Data Management below for details). Importantly, Copilot prompts and suggestions are ephemeral or short-lived for Business users (often not stored at all), which supports compliance with privacy principles of data minimization.

4. Data Management

4.1 Server Location and Data Residency

GitHub Copilot operates using cloud infrastructure. When a developer uses Copilot for code completions or chat, their code prompt is sent to GitHub’s service which then queries a large language model. By default, these requests are handled in Microsoft Azure’s cloud environment, which is primarily in the United States (for example, GitHub lists OpenAI – based in the US – as a sub‑processor for Copilot’s AI services)【46†L150-L158】. The Copilot service does not currently offer a UK‑only or on‑premise deployment; data will flow to the region(s) where the AI model is hosted. GitHub has introduced an EU data residency option for GitHub Enterprise Cloud (for repository storage) in general, but Copilot’s model processing is global – as of 2025, prompts may be processed on servers in the US or other Azure regions, because the underlying AI (OpenAI’s Codex/GPT model and others) runs in those locations【46†L150-L158】.

However, all Copilot for Business customers are covered by the aforementioned Data Protection Agreement which includes standard safeguards for international data transfer. For example, if UK (or EU) personal data is involved in Copilot telemetry, GitHub (as a data processor under Microsoft) will ensure compliance via Standard Contractual Clauses or an equivalent mechanism as part of the DPA【42†L1-L9】.

In terms of data residency: Your source code in GitHub repositories can be kept in a chosen region (e.g., GitHub’s EU hosting option) if using GitHub Enterprise Cloud data residency features, but the Copilot service (which analyzes code to generate suggestions) is not region‑isolated. Therefore, UK government organizations should be aware that code fragments sent to Copilot’s AI could leave the UK/EU. The data is encrypted and not stored long term (see below), mitigating some risk. If this is a concern, agencies might choose to disable Copilot on highly sensitive projects or monitor upcoming features, as GitHub is continuously improving regional infrastructure and may introduce more localization in the future.

4.2 Data in Transit

All data in transit between the user’s environment and the Copilot cloud service is encrypted. When Copilot transmits code context (prompts) from the IDE to GitHub’s servers, it uses TLS (Transport Layer Security) encryption【48†L203-L211】. This means that network traffic containing your code and Copilot’s responses is protected from eavesdropping or interception, meeting government standards (e.g., TLS 1.2+ and FIPS‑compliant ciphers).

Specifically, GitHub has stated: “The transmitted data is encrypted in transit using Transport Layer Security (TLS)”【48†L205-L213】. This applies to all Copilot interfaces (IDE plugin, web, CLI, etc.). In practice, the communication goes from your editor plugin to a GitHub endpoint (over HTTPS), then from GitHub’s service to the AI model (likely also within Azure’s secure network).

Additionally, Copilot for Business uses Azure’s secure infrastructure. Data in transit within Azure (between services or data centers) is also encrypted, and Microsoft’s cloud meets FIPS 140‑2 encryption standards for both transit and storage of data【48†L205-L213】. This level of encryption satisfies UK government cloud security principle #4 (protecting data in transit) as recommended by the NCSC.

4.3 Data at Rest

Data at rest refers to any information stored on disk as part of the Copilot service. GitHub Copilot for Business is designed to minimize persistent storage of your code. In general, prompts (your code snippets and queries) are not permanently stored on Copilot servers【48†L207-L214】【50†L7-L10】. For the Business plan, when Copilot receives a prompt from a user’s IDE, it uses it to generate a suggestion and “prompts only persist long enough to return a response … and are then immediately discarded”, with all processing happening in memory【50†L7-L10】. This means that your actual code content is not written to any database or file by the suggestion service in normal operation.

Some data is retained at rest for logging and telemetry (see Data Retention below), but such data is encrypted at rest using Azure’s encryption mechanisms. GitHub has confirmed that Copilot-related data is encrypted at rest using Microsoft Azure’s data encryption, compliant with FIPS 140‑2 standards【48†L205-L213】. This covers any cached data, logs, or feedback stored by the service. Azure’s encryption implies using strong algorithms (AES‑256 or similar) to encrypt data on disk, with secure key management.

For Copilot’s newer features like Copilot Chat on the web or mobile, there is short‑term storage of conversation history (again, see retention section), which is also stored in encrypted form. No other parties have access to this data; it remains under GitHub/Microsoft’s control in secure cloud storage.

Additionally, access controls protect data at rest: only authorized systems and personnel can access Copilot logs or stored data, and GitHub’s ISO 27001‑compliant processes govern this access【41†L491-L500】. From a UK government standpoint, encryption at rest and strict access controls align with security principle #5 (protecting data at rest).

4.4 Data Retention

GitHub Copilot for Business retains different categories of data for different periods, with a principle of minimizing retention of actual code content. According to GitHub’s Copilot Trust Center FAQ, the default retention policies are:

  • Prompts and Suggestions (Code Content): For normal usage via an IDE/plugin, Copilot does not retain prompts or the AI suggestions at all【29†L622-L630】. They are processed in memory and discarded once the suggestion is delivered. This means if you use Copilot in VS Code, for example, the code you typed and the completion you got are not stored on GitHub’s servers. However, if using Copilot in certain contexts that require history (specifically, Chat on GitHub.com, Copilot CLI, or Copilot in GitHub Mobile), then prompts and responses are retained for a short duration (to maintain state in a conversation): up to 28 days by default【29†L634-L640】. After 28 days, those chat prompts and responses are deleted. In all cases, 28 days is the maximum for any code content retention, and 0 days for the typical IDE usage mode.
  • User Engagement Data: This refers to metadata like events of accepting a suggestion, dismissing it, or general usage metrics. Copilot for Business retains engagement and usage logs for 2 years【29†L628-L636】【29†L634-L640】. This data helps GitHub analyze service usage and performance, and is also used for auditing (e.g., to compute metrics for enterprise reports). The data might include, for instance, an entry that a particular user requested X number of completions on a given date, etc., but not the content of those completions. Two years is a typical window that balances usefulness (trend analysis, debugging) with limiting indefinite storage.
  • Feedback Data: If users explicitly provide feedback (for example, clicking a thumbs‑up or thumbs‑down on a suggestion, or sending a report), that feedback is stored as long as necessary for its purpose【29†L628-L636】【28†L640-L648】. There isn’t a fixed timeframe given, but it implies it could be kept to improve the model or investigate issues, until it’s no longer needed. This category is likely minimal and often anonymized or aggregated.

These retention policies mean that for Copilot Business, your actual code is largely not retained beyond the immediate use. Only in chat scenarios might it live up to 28 days on the server (to allow continuity in multi‑turn conversations). Government users should be aware that if they use Copilot’s chat interface (for example, asking it questions on the GitHub website), whatever code or query they enter might be stored for up to four weeks in a secure datastore, after which it will be purged【29†L634-L640】.

For auditing and transparency, GitHub provides these details publicly【29†L619-L628】【29†L634-L640】. The approach meets the principle of data minimization under GDPR/UK GDPR. If needed —for example, in response to a subject‑access request—the GitHub Privacy Statement notes that users can request deletion of personal data, which would cover any Copilot logs tied to an individual【28†L665-L672】. In practice, most code content never touches disk, and ephemeral handling is a key design feature of Copilot for Business.

5. Audit Logging

GitHub Copilot for Business includes audit and monitoring capabilities so that enterprise administrators can track usage and changes related to Copilot within their organization. These features help meet governance requirements by providing a trail of important actions.

Organization Audit Log Integration: Activities related to Copilot are integrated into GitHub’s organization audit log (the same log that records repo access, settings changes, etc., for an org). For organizations using Copilot Business, the audit log will record events such as:

  • Policy or Settings Changes – e.g., enabling or disabling Copilot features, changing the “suggestions matching public code” setting, toggling a model choice, or updating content exclusion rules. Any change an org owner makes to Copilot policy will generate an audit log entry with details of who changed what and when【55†L296-L303】.
  • License (Seat) Management – e.g., assigning a Copilot seat to a user, or removing a user from the Copilot Business plan. These actions are logged (with events like copilot.cfb_seat_assignment_created for adding a user)【55†L318-L326】. This allows tracking of which developers have been given access to Copilot.
  • Possibly User‑level events – the audit log may note if a user enabled or disabled Copilot for themselves (though in Business context, user‑level control is limited by org policy). Primarily it’s admin actions that are logged.

These audit log entries are accessible to organization owners. They can be viewed via the standard GitHub audit log interface (UI or API) and can be filtered by the “copilot” category【55†L312-L320】. The log data is retained for at least 180 days in the audit log (as per GitHub’s audit log retention policy for enterprises)【55†L300-L307】【55†L302-L304】.

Additionally, GitHub provides a Copilot user activity report that organization owners can review. This is separate from raw audit logs – it’s more of a summary of usage (e.g., how often Copilot is being used, which teams use it most, etc.)【52†L275-L284】. This helps in understanding the value and adoption, and in making decisions about seat assignments (for example, freeing a license if an assigned user isn’t using the tool)【52†L277-L285】.

For security monitoring: the audit logs can be exported or integrated into SIEM tools if an organization wishes, just like other GitHub audit data. UK Government administrators can use this to verify that Copilot is being used in accordance with policy — for instance, one could query the logs to ensure no one changed the “block public code” setting without approval.

In summary, Copilot Business provides full transparency of administrative actions and high‑level usage through audit logs【55†L294-L303】【55†L318-L326】. However, it does not log the contents of code suggestions or prompts for audit purposes (to preserve privacy). It focuses on when and by whom Copilot was enabled, configured, or used, which aligns with typical compliance needs.

6. Access Controls

Access to GitHub Copilot for Business is managed through GitHub organizations and their membership, ensuring that only authorized users (developers) in the organization can utilise the AI assistant. Key points about how access and permissions work:

  • License Assignment – Copilot for Business is provisioned per‑user “seat”. Organisation owners (or admins with the right privileges) assign Copilot seats to individual developers or teams within the organisation【20†L507-L515】. Only users with an assigned seat can actually use Copilot under the org’s subscription. Removing the seat immediately revokes access.
  • Authentication and Access – Copilot usage is tied to the user’s GitHub account. The organisation can (and should) enforce strong authentication (e.g. SSO via Azure AD and mandatory 2FA). There is no separate login for Copilot; it inherits normal GitHub identity management, so central off‑boarding disables Copilot too.
  • Administrative Controls – Only organisation owners can configure organisation‑wide Copilot settings【1†L278-L285】. Regular developers cannot override settings that the org admin has locked (e.g. public‑code filter, model choice)【21†L330-L338】.
  • Repository‑Level Controls – Repo admins can set content‑exclusion rules to stop Copilot seeing certain paths【25†L304-L312】. Seat assignment also governs which developers (and therefore which repos) can use Copilot.
  • No Autonomous Actions – Copilot itself cannot commit or push code. Suggestions appear only in the user’s editor buffer; the developer must explicitly accept and commit changes. Pull‑request summaries or similar features require user initiation and confirmation.
  • Least‑Privilege & API Access – The IDE extension uses a minimal‑scope OAuth token (read‑only context). Copilot does not have write or admin privileges on repositories. Tokens can be revoked by admins at any time.
  • Prevention of Sensitive Data Input – Organisations can train developers not to prompt Copilot with classified or personal data and can use content exclusions to enforce this. Copilot policies ensure sensitive files remain untouched.
  • Monitoring and Revocation – If misuse is suspected, admins can disable Copilot for specific users or across the org instantly. Audit logs (see section 5) capture these actions.

These controls allow UK government teams to tightly manage who uses Copilot and under what conditions, aligning with existing DevSecOps and identity governance practices.

7. Compliance and Regulatory Requirements

GitHub Copilot for Business has been developed with enterprise compliance in mind. Microsoft (GitHub’s parent company) and GitHub have made efforts to align Copilot with common security and legal standards, which is important for UK government adoption. Below is a list of relevant certifications, standards, and compliance measures:

  • SOC 2 (Service Organization Control 2): GitHub Copilot for Business has undergone a SOC 2 audit. In mid‑2024, GitHub announced a SOC 2 Type I report covering Copilot Business (including code completion and chat features)【41†L482-L490】. A SOC 2 Type I indicates that the design of security controls was assessed by independent auditors. Furthermore, GitHub stated that Copilot Business and Enterprise will be included in a SOC 2 Type II report (covering operational effectiveness of controls over time) by late 2024【41†L485-L492】. This gives assurance that Copilot’s security controls (for security, availability, confidentiality, etc.) meet the industry standards. UK Government security reviewers can request these SOC 2 reports (GitHub makes them available under NDA) to verify the controls.
  • ISO/IEC 27001:2013: GitHub’s overall Information Security Management System (ISMS) is ISO 27001 certified, and as of May 2024, Copilot Business and Enterprise are included in the scope of GitHub’s ISO/IEC 27001 certification【41†L491-L500】. This means the processes and controls for Copilot development and operations adhere to the ISO 27001 standard. ISO 27001 is often a requirement or strong preference in government IT procurement, indicating a mature security programme. By including Copilot, GitHub shows that things like risk management, incident response, and access control for the Copilot service are covered under their audited ISMS.
  • SOC 2 Type II and Other Audits: (Expected by early 2025) Once the Type II report is available, it will cover a six‑month period of Copilot’s operations【41†L485-L492】. Additionally, GitHub participates in the Cloud Security Alliance (CSA) CAIQ self‑assessment; Copilot likely falls under GitHub’s responses there. Government customers can ask for GitHub’s CSA STAR registry entry or similar documentation for cloud controls. While not explicitly listed in sources, Microsoft’s enterprise cloud pedigree suggests Copilot is being aligned with SOC 3, FedRAMP (for US government), etc., though FedRAMP is not directly applicable to UK government, it shows a level of rigour.
  • GDPR / UK GDPR: GitHub Copilot supports compliance with European and UK data‑protection laws. GitHub will sign a Data Protection Agreement (DPA) with customers to meet GDPR requirements【42†L1-L9】. The DPA includes commitments on data handling, breach notification, sub‑processor transparency, and Standard Contractual Clauses for international transfers. In the Copilot FAQ, GitHub explicitly answers “Does Copilot support GDPR compliance?” with Yes【42†L1-L9】. For UK public‑sector use, this means data‑protection impact can be managed — GitHub acts as a data processor for any personal data in Copilot telemetry, while the government organisation remains the controller. As discussed, Copilot minimises personal‑data processing, but the DPA covers any that does occur (e.g. a user’s name or ID, or incidental personal data in code). UK organisations should ensure they have this DPA in place (usually via the Microsoft Enterprise Agreement or GitHub Enterprise agreement).
  • Sub‑processors and Third‑Party Contracts: GitHub publishes a list of sub‑processors (such as OpenAI, providing the AI model service)【46†L150-L158】. OpenAI is an important third‑party involved in Copilot’s functionality. GitHub’s DPA and privacy statement ensure that sub‑processor relationships are governed by equivalent data‑protection obligations. Microsoft/GitHub have contracts in place with OpenAI to protect data, and they flow down the EU Model Clauses as needed. As new models (Anthropic, Google) are integrated, similar protections will apply. UK government users should be aware of these US‑based AI providers when assessing risk, but can take comfort in the contractual safeguards.
  • Responsible AI Principles: While not a certification, Microsoft and GitHub emphasise responsible‑AI usage. GitHub has a Copilot Trust Center and documentation on responsible use, which align with principles such as fairness, privacy, and transparency. For example, they disclose limitations and provide the IP filter to address copyright concerns. This ethos aligns with UK government’s AI ethics guidance and the NCSC’s advice to assess AI tools for unintended outputs.
  • NCSC Cloud Security Principles Alignment: Many of the NCSC’s 14 cloud‑security principles are reflected in Copilot for Business’s design:
      - Data in transit protection (Principle 4) — implemented via TLS encryption【48†L205-L213】.
      - Asset protection & data separation (Principles 3 & 5) — Copilot data is encrypted at rest and kept logically separate; private‑repo content is not commingled in other customers’ suggestions.
      - Identity and authentication (Principle 10) — relies on GitHub’s robust account security with SSO/2FA support.
      - Secure operations (Principle 11) — ISO 27001 and SOC reports evidence operational security and change‑management controls【41†L491-L500】.
      - Supply‑chain security (Principle 12) — OpenAI and other suppliers are under contract; Microsoft oversight mitigates risks.

  While not formally evaluated by NCSC, these measures allow an organisation to make a strong case that using Copilot Business is consistent with government cloud‑security guidance.

  • Additional Certifications: GitHub (as part of Microsoft) also maintains ISO 27017 (cloud security) and ISO 27018 (cloud privacy) certifications, and complies with SOC 1 and PCI‑DSS for relevant services. Copilot is likely covered by ISO 27018 since it falls under the same ISMS. HIPAA is not applicable unless healthcare data is pasted into Copilot (which should be avoided); GitHub makes no HIPAA claim for Copilot.

In summary, GitHub Copilot for Business arrives with a strong compliance footing: SOC 2 Type I report available, ISO 27001 certified, GDPR‑aligned DPA, and alignment with NCSC guidance【41†L482-L490】【41†L491-L500】【42†L1-L9】. UK Government organisations should obtain the SOC 2 reports and DPA for assurance, then conduct a local risk assessment based on the sensitivity of code they plan to process through Copilot.