Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The document states, in response to the FAQ question, that GitHub does not use Copilot Business or Enterprise customer data to train AI models.
This analysis describes what GitHub's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision is the most operationally significant data use commitment on the Trust Center page for enterprise customers, as it defines the boundary of how prompt and engagement data submitted through Business and Enterprise tiers may be used by GitHub.
Interpretive note: The commitment appears in a FAQ section of a Trust Center informational page rather than in a binding contractual document; the legal weight of this statement depends on whether it is reflected in GitHub's Terms of Service or Data Processing Agreement.
Under this disclosure, enterprise and business subscribers' prompts, suggestions, feedback, and engagement data are stated to be excluded from use in training GitHub's AI models, distinguishing these tiers from individual consumer-tier data handling.
Cross-platform context
See how other platforms handle No AI Model Training on Business and Enterprise Data and similar clauses.
Compare across platforms →Monitoring
GitHub has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Does GitHub use Copilot Business or Enterprise data to train AI models?Excerpt from GitHub's Copilot Business Privacy Statement
(1) REGULATORY LANDSCAPE: This commitment engages GDPR requirements regarding purpose limitation and data use transparency enforced by EU supervisory authorities, as well as CCPA provisions regarding the use of personal information. Enterprise customers subject to GDPR should assess whether this commitment is reflected in a binding Data Processing Agreement rather than solely in a public Trust Center page, as GDPR requires contractual safeguards for processor relationships. (2) GOVERNANCE EXPOSURE: Medium. The commitment is stated in a FAQ format on a public informational page rather than in a binding contractual instrument; if not mirrored in the Data Protection Agreement or Terms of Service, the legal enforceability of this commitment may be limited and subject to unilateral change. (3) JURISDICTION FLAGS: EU and UK enterprise customers face heightened exposure given GDPR and UK GDPR obligations requiring that data processor agreements reflect the full scope of permitted data processing; a Trust Center FAQ statement alone may not satisfy processor agreement requirements under Article 28 of GDPR. California enterprise customers should assess CCPA service provider contract requirements. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should include this no-training commitment as a contractual obligation in vendor agreements or Data Processing Addenda when contracting for Copilot Business or Enterprise. The absence of this commitment in binding contract language creates a due diligence gap that could affect vendor risk assessments. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should obtain GitHub's current Data Processing Agreement and verify that the no-training commitment for Business and Enterprise tiers is explicitly stated as a contractual obligation. Any future Trust Center updates modifying this commitment should trigger a contract review process.
This provision is the most operationally significant data use commitment on the Trust Center page for enterprise customers, as it defines the boundary of how prompt and engagement data submitted through Business and Enterprise tiers may be used by GitHub.
Under this disclosure, enterprise and business subscribers' prompts, suggestions, feedback, and engagement data are stated to be excluded from use in training GitHub's AI models, distinguishing these tiers from individual consumer-tier data handling.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by GitHub.