Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The Trust Center discloses that GitHub Copilot holds CSA STAR Level 2 certification, indicating a third-party audit of cloud security controls against the Cloud Security Alliance Cloud Controls Matrix.
This analysis describes what GitHub's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
CSA STAR Level 2 certification requires an independent third-party assessment of cloud security controls, providing enterprise customers with additional audited assurance beyond the SOC 2 Type 2 attestation, specifically framed around cloud computing security practices.
Individual CSA STAR Level 2 badge removed but certification retained in consolidated section, reflecting change from individual badge display to unified compliance table.
View full change record →CSA STAR Level 2 certification changed from plain text reference to badge-displayed format.
View full change record →This provision discloses that GitHub Copilot has undergone third-party assessment under the CSA Cloud Controls Matrix at Level 2, which institutional customers may reference in cloud vendor risk assessments.
How other platforms handle this
prevent or detect violations of our Terms or fraud or abuse of Strava or its users; or (4) protect our operations or our property or other legal rights, including in connection with actual or potential litigation.
the Receiving Party shall (other than to the extent prohibited by law) provide prior written notice to the Disclosing Party and reasonably cooperate...with any efforts by the Disclosing Party to contest or limit such disclosure requirement
Recipient may disclose Discloser's Confidential Information: (i) to the extent that such disclosure is required by applicable law or by the order of a court...provided that...the Recipient promptly notifies the Discloser in writing of such required disclosure...
Monitoring
GitHub has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"CSA STAR Level 2 [badge displayed]Excerpt from GitHub's Copilot Business Privacy Statement
(1) REGULATORY LANDSCAPE: CSA STAR Level 2 engages with cloud security frameworks referenced by GDPR guidance on processor security measures and by sector-specific cloud security policies in financial services and public sector procurement. The Cloud Security Alliance administers the STAR registry; no government enforcement authority directly governs STAR certification. (2) GOVERNANCE EXPOSURE: Low. CSA STAR Level 2 is a standard assurance mechanism for enterprise cloud vendors and its disclosure is consistent with common practice for major cloud-adjacent SaaS providers. (3) JURISDICTION FLAGS: EU/EEA organizations may reference CSA STAR Level 2 in GDPR processor assessments. Public sector and financial services organizations in various jurisdictions maintain specific cloud security procurement requirements that may reference CSA CCM alignment. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should confirm whether the CSA STAR Level 2 certification scope covers the specific Copilot services being engaged. The CSA STAR registry provides public listings of certified organizations, allowing independent verification. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should verify the current status of the CSA STAR Level 2 certification via the public CSA STAR registry and document scope coverage as part of cloud vendor due diligence. Certification renewal timelines should be monitored.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
CSA STAR Level 2 certification requires an independent third-party assessment of cloud security controls, providing enterprise customers with additional audited assurance beyond the SOC 2 Type 2 attestation, specifically framed around cloud computing security practices.
This provision discloses that GitHub Copilot has undergone third-party assessment under the CSA Cloud Controls Matrix at Level 2, which institutional customers may reference in cloud vendor risk assessments.
ConductAtlas has identified this type of provision across 279 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by GitHub.