Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
Full SOC 1 Type 2 and SOC 2 Type 2 reports, as well as bridge letters covering December 2025, are not publicly downloadable and require submission of an access request through the Trust Center portal.
This analysis describes what GitHub's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision requires organizations to complete a formal access request process before reviewing the underlying audit evidence that typically forms the basis of vendor due diligence assessments, which may introduce timeline dependencies in procurement workflows.
Removal indicates shift from access-gated compliance documentation to publicly accessible compliance disclosures, improving transparency.
View full change record →Introduction of access-gated audit documents indicates GitHub now restricts SOC 1 and SOC 2 Type 2 reports behind authentication/approval mechanisms.
View full change record →Under this portal structure, organizations and users cannot directly download SOC audit reports or bridge letters; the agreement requires submission of a formal access request to obtain these compliance documents.
How other platforms handle this
to notify the Disclosing Party promptly and in writing of the circumstances surrounding any suspected possession, use or knowledge of the Confidential Information
Atlassian will also maintain a compliance program that includes independent third-party audits and certifications, as described in its Security Measures.
Any non-binding quotes provided by the Zillow Companies for Third-Party Providers' financial products are not intended to be official Loan Estimates as defined in the Real Estate Settlement Procedures Act or the Truth in Lending Act...
Monitoring
GitHub has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"GitHub.Enterprise.Cloud.SOC.1.Type.2.-.Bridge.Letter.01.Dec.2025.-.31.Dec.2025.pdf [lock icon] ... GitHub.Enterprise.Cloud.SOC.2.Type.2.-.Bridge.Letter.01.Dec.2025.-.31.Dec.2025.pdf [lock icon]Excerpt from GitHub's Copilot Business Privacy Statement
(1) REGULATORY LANDSCAPE: Under GDPR, organizations acting as data controllers must assess the security measures of processors before engagement; access to SOC 2 Type 2 reports is a standard mechanism for this assessment. Gated report access does not prevent compliance but may affect the timeline of vendor approval processes. The relevant enforcement authorities are EU member state data protection authorities. (2) GOVERNANCE EXPOSURE: Low. Gated audit report access is a standard practice among enterprise SaaS vendors and does not itself create compliance exposure. The mechanism is procedural rather than substantive. (3) JURISDICTION FLAGS: EU/EEA organizations subject to GDPR processor assessment obligations and organizations in regulated sectors such as financial services or healthcare that require audit evidence before vendor onboarding may experience procurement friction due to the access request requirement. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should initiate the access request process early in vendor evaluation cycles. B2B contracts with GitHub may include provisions for ongoing access to audit reports; legal teams should verify whether the access request mechanism satisfies contractual audit rights obligations. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should document the access request submission and report receipt as part of the vendor due diligence file. Organizations with annual vendor reassessment obligations should calendar report refresh cycles, noting that bridge letters are available for the period ending December 2025.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision requires organizations to complete a formal access request process before reviewing the underlying audit evidence that typically forms the basis of vendor due diligence assessments, which may introduce timeline dependencies in procurement workflows.
Under this portal structure, organizations and users cannot directly download SOC audit reports or bridge letters; the agreement requires submission of a formal access request to obtain these compliance documents.
ConductAtlas has identified this type of provision across 279 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by GitHub.