GitHub Copilot Business Privacy Statement

The submitted document is the GitHub Copilot Trust Center page, hosted via Vanta's trust portal infrastructure, and functions as a compliance and transparency disclosure hub rather than a formal privacy policy with stated legal bases such as GDPR Article 6 or CCPA-defined purposes. The page discloses that GitHub Copilot holds certifications including SOC 1, SOC 2, SOC 3, ISO 27001:2013, ISO/IEC 42001:2023, CSA STAR Level 2, and TISAX, and makes available access-controlled compliance reports including SOC 1 Type 2, SOC 2 Type 2, and bridge letters for the period December 2025. The document is a trust and compliance marketing and disclosure portal, not a binding privacy policy or terms of service; it does not contain data processing clauses, consent mechanisms, data retention schedules, or dispute resolution provisions. The certifications disclosed, particularly ISO/IEC 42001:2023 (AI management systems) and SOC 2 Type 2, are operationally relevant under enterprise procurement and regulatory frameworks including the EU AI Act and GDPR, where institutional customers may require these attestations as part of vendor due diligence or data processing agreement obligations. Compliance teams evaluating GitHub Copilot as a vendor should note that access to the full SOC reports and bridge letters requires a formal access request through the portal, limiting self-service due diligence.