Full SOC 1 Type 2 and SOC 2 Type 2 reports, as well as bridge letters covering December 2025, are not publicly downloadable and require submission of an access request through the Trust Center portal.
This analysis describes what GitHub's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision requires organizations to complete a formal access request process before reviewing the underlying audit evidence that typically forms the basis of vendor due diligence assessments, which may introduce timeline dependencies in procurement workflows.
Removal indicates shift from access-gated compliance documentation to publicly accessible compliance disclosures, improving transparency.
View full change record →Introduction of access-gated audit documents indicates GitHub now restricts SOC 1 and SOC 2 Type 2 reports behind authentication/approval mechanisms.
View full change record →Under this portal structure, organizations and users cannot directly download SOC audit reports or bridge letters; the agreement requires submission of a formal access request to obtain these compliance documents.
How other platforms handle this
to notify the Disclosing Party promptly and in writing of the circumstances surrounding any suspected possession, use or knowledge of the Confidential Information
Consistent with applicable law, you understand and agree that Tinder may not share information with you regarding your account termination if doing so would potentially impair the safety or privacy of other users.
within the Services, all discussion boards, groups, or other public forums available to participants are publicly visible to other participants.
"GitHub.Enterprise.Cloud.SOC.1.Type.2.-.Bridge.Letter.01.Dec.2025.-.31.Dec.2025.pdf [lock icon] ... GitHub.Enterprise.Cloud.SOC.2.Type.2.-.Bridge.Letter.01.Dec.2025.-.31.Dec.2025.pdf [lock icon]Excerpt from GitHub's Copilot Business Privacy Statement
(1) REGULATORY LANDSCAPE: Under GDPR, organizations acting as data controllers must assess the security measures of processors before engagement; access to SOC 2 Type 2 reports is a standard mechanism for this assessment.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision requires organizations to complete a formal access request process before reviewing the underlying audit evidence that typically forms the basis of vendor due diligence assessments, which may introduce timeline dependencies in procurement workflows.
Under this portal structure, organizations and users cannot directly download SOC audit reports or bridge letters; the agreement requires submission of a formal access request to obtain these compliance documents.
ConductAtlas has identified this type of provision across 273 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by GitHub.