{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:b600627d-73c4-5c8f-baee-83cbedd09366",
  "version": 1,
  "metadata": {
    "timestamp": "2026-11-04T00:00:00Z"
  },
  "components": [
    {
      "type": "machine-learning-model",
      "bom-ref": "https://jesseahawkins.com/vendors/github-copilot/aibom/component",
      "name": "GitHub Copilot: GitHub Copilot Business and Enterprise",
      "properties": [
        {
          "name": "com.jesseahawkins:fact:ai_subprocessors",
          "value": "A published list; new names 30 days in advance"
        },
        {
          "name": "com.jesseahawkins:evidence:ai_subprocessors",
          "value": "snapshot:sha256:fafcdb7003b578650b127a8fab76f9970f860fb04ea0e0cc28f50c4ff0f81407"
        },
        {
          "name": "com.jesseahawkins:recorded-at:ai_subprocessors",
          "value": "2026-10-26T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:ai_subprocessors",
          "value": "2026-10-26"
        },
        {
          "name": "com.jesseahawkins:responsive-to:ai_subprocessors",
          "value": "dora-roi@2024-2956:B_05.02 iso-42001@2023:A.10.2 iso-42001@2023:A.10.3 nist-ai-rmf@1.0:GOVERN-6.1 nist-ai-rmf@1.0:MANAGE-3.1"
        },
        {
          "name": "com.jesseahawkins:fact:customer_data_retention_period",
          "value": "Not kept in the IDE; 28 days for other use, with listed exceptions"
        },
        {
          "name": "com.jesseahawkins:evidence:customer_data_retention_period",
          "value": "snapshot:sha256:30826739dddc8befe67f24935ff304a2a9924bccdae74cb429ccfe8f73d2b423"
        },
        {
          "name": "com.jesseahawkins:recorded-at:customer_data_retention_period",
          "value": "2026-10-26T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:customer_data_retention_period",
          "value": "2026-10-26"
        },
        {
          "name": "com.jesseahawkins:responsive-to:customer_data_retention_period",
          "value": "iso-42001@2023:A.7.3 nist-ai-rmf@1.0:MEASURE-2.10"
        },
        {
          "name": "com.jesseahawkins:fact:data_residency",
          "value": "Listed for each sub-processor; AI inference in the US and other countries"
        },
        {
          "name": "com.jesseahawkins:evidence:data_residency",
          "value": "snapshot:sha256:fafcdb7003b578650b127a8fab76f9970f860fb04ea0e0cc28f50c4ff0f81407"
        },
        {
          "name": "com.jesseahawkins:recorded-at:data_residency",
          "value": "2026-10-26T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:data_residency",
          "value": "2026-10-26"
        },
        {
          "name": "com.jesseahawkins:fact:dpa",
          "value": "GitHub’s Data Protection Agreement, for business customers"
        },
        {
          "name": "com.jesseahawkins:evidence:dpa",
          "value": "snapshot:sha256:30826739dddc8befe67f24935ff304a2a9924bccdae74cb429ccfe8f73d2b423"
        },
        {
          "name": "com.jesseahawkins:recorded-at:dpa",
          "value": "2026-10-26T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:dpa",
          "value": "2026-10-26"
        },
        {
          "name": "com.jesseahawkins:fact:trains_on_customer_data",
          "value": "No"
        },
        {
          "name": "com.jesseahawkins:evidence:trains_on_customer_data",
          "value": "snapshot:sha256:30826739dddc8befe67f24935ff304a2a9924bccdae74cb429ccfe8f73d2b423"
        },
        {
          "name": "com.jesseahawkins:recorded-at:trains_on_customer_data",
          "value": "2026-10-26T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:trains_on_customer_data",
          "value": "2026-10-26"
        },
        {
          "name": "com.jesseahawkins:responsive-to:trains_on_customer_data",
          "value": "eu-ai-act@2026-07-27:annex-iv/2/d eu-ai-act@2026-07-27:annex-xi/s1/2/c iso-42001@2023:A.7.3 iso-42001@2023:A.7.5 nist-ai-rmf@1.0:MEASURE-2.10"
        },
        {
          "name": "com.jesseahawkins:fact:trains_on_free_use",
          "value": "Yes on Free, Pro and Pro+, unless the user opts out"
        },
        {
          "name": "com.jesseahawkins:evidence:trains_on_free_use",
          "value": "snapshot:sha256:30826739dddc8befe67f24935ff304a2a9924bccdae74cb429ccfe8f73d2b423"
        },
        {
          "name": "com.jesseahawkins:recorded-at:trains_on_free_use",
          "value": "2026-10-26T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:trains_on_free_use",
          "value": "2026-10-26"
        },
        {
          "name": "com.jesseahawkins:fact:usage_limits",
          "value": "A monthly allowance of AI credits per plan; on Business and Enterprise, admins set limits on paid usage beyond it; GitHub’s own rate limits have no published numbers"
        },
        {
          "name": "com.jesseahawkins:evidence:usage_limits",
          "value": "snapshot:sha256:30826739dddc8befe67f24935ff304a2a9924bccdae74cb429ccfe8f73d2b423"
        },
        {
          "name": "com.jesseahawkins:recorded-at:usage_limits",
          "value": "2026-10-26T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:usage_limits",
          "value": "2026-10-26"
        },
        {
          "name": "com.jesseahawkins:withheld:certifications",
          "value": "no-value"
        },
        {
          "name": "com.jesseahawkins:withheld:zero_data_retention",
          "value": "no-value"
        },
        {
          "name": "com.jesseahawkins:quote:ai_subprocessors",
          "value": "GitHub publishes the names of any new subprocessors for its online services at least 30 days in advance of the subprocessor’s authorization to perform services that may involve access to customer data or personal data."
        },
        {
          "name": "com.jesseahawkins:source:ai_subprocessors",
          "value": "https://docs.github.com/en/site-policy/privacy-policies/github-subprocessors"
        },
        {
          "name": "com.jesseahawkins:quote:customer_data_retention_period",
          "value": "Access through IDE for Chat and Code Completions: Prompts and Suggestions: Not retained User Engagement Data: Kept for two years. Feedback Data: Stored for as long as needed for its intended purpose. All other GitHub Copilot access and use: Prompts and Suggestions: Retained for 28 days."
        },
        {
          "name": "com.jesseahawkins:source:customer_data_retention_period",
          "value": "https://github.com/features/copilot"
        },
        {
          "name": "com.jesseahawkins:quote:data_residency",
          "value": "Google Cloud Platform (GCP) Cloud Hosted Infrastructure, AI Inference and AI Services United States, Belgium, Singapore"
        },
        {
          "name": "com.jesseahawkins:source:data_residency",
          "value": "https://docs.github.com/en/site-policy/privacy-policies/github-subprocessors"
        },
        {
          "name": "com.jesseahawkins:quote:dpa",
          "value": "These practices are outlined in GitHub’s Data Protection Agreement (DPA), which details our data handling commitments to our data controller customers."
        },
        {
          "name": "com.jesseahawkins:source:dpa",
          "value": "https://github.com/features/copilot"
        },
        {
          "name": "com.jesseahawkins:quote:trains_on_customer_data",
          "value": "No. GitHub does not use either Copilot Business or Enterprise data to train its models."
        },
        {
          "name": "com.jesseahawkins:source:trains_on_customer_data",
          "value": "https://github.com/features/copilot"
        },
        {
          "name": "com.jesseahawkins:quote:trains_on_free_use",
          "value": "Starting on April 24, GitHub may also use interactions from users with a Copilot Free, Copilot Pro, and Copilot Pro+ subscription - including inputs, outputs, code snippets, and associated context - to train and improve our AI models unless they have opted out."
        },
        {
          "name": "com.jesseahawkins:source:trains_on_free_use",
          "value": "https://github.com/features/copilot"
        },
        {
          "name": "com.jesseahawkins:quote:usage_limits",
          "value": "On GitHub Copilot Business and GitHub Copilot Enterprise, admins set usage limits and decide whether additional paid usage is allowed. If it isn't, Copilot pauses until the next cycle."
        },
        {
          "name": "com.jesseahawkins:source:usage_limits",
          "value": "https://github.com/features/copilot"
        }
      ]
    }
  ],
  "properties": [
    {
      "name": "com.jesseahawkins:vendor",
      "value": "github-copilot"
    },
    {
      "name": "com.jesseahawkins:record",
      "value": "https://jesseahawkins.com/vendors/github-copilot/"
    },
    {
      "name": "com.jesseahawkins:notice",
      "value": "This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."
    },
    {
      "name": "com.jesseahawkins:signed",
      "value": "false"
    },
    {
      "name": "com.jesseahawkins:signature-note",
      "value": "The AIBOM files of this record are not signed. A signature waits on a signing key held in a key management service. Until then, check each quote against the kept page and its sha256."
    }
  ]
}