Vendors · Questionnaire · GitHub Copilot
Read GitHub Copilot’s own answers to nine buyer questions
GitHub Copilot Business and Enterprise. Each answer quotes GitHub Copilot’s own page or feed as kept on the day shown. Each question cites the NIST text that asks it. The answers are not a score and not a verdict.
GitHub Copilot in the vendor record github-copilot-questionnaire.csv
Q1
Does the vendor train its models on business and API customers’ data?
NIST AI 600-1, action GV-6.2-007: “… contribute to unauthorized data collection by vendors or third-parties (e.g., secondary data use) …”
NIST AI RMF 1.0, MEASURE 2.10
No
No. GitHub does not use either Copilot Business or Enterprise data to train its models.
Answer to “Does GitHub use Copilot Business or Enterprise data to train GitHub’s model?” GitHub Copilot, frequently asked questions, kept 26 Oct 2026 · sha256 30826739dddc
Q2
Does the vendor train its models on free and consumer use of its products?
NIST AI 600-1, action GV-6.2-007: “… contribute to unauthorized data collection by vendors or third-parties (e.g., secondary data use) …”
NIST AI RMF 1.0, MEASURE 2.10
Yes on Free, Pro and Pro+, unless the user opts out
Starting on April 24, GitHub may also use interactions from users with a Copilot Free, Copilot Pro, and Copilot Pro+ subscription - including inputs, outputs, code snippets, and associated context - to train and improve our AI models unless they have opted out.
GitHub Copilot, frequently asked questions, kept 26 Oct 2026 · sha256 30826739dddc
Q3
How long does the vendor keep the data that customers send?
NIST AI 600-1, action GV-6.1-004: “Draft and maintain well-defined contracts and service level agreements (SLAs) that specify content ownership, usage rights, quality standards, security requirements, and content provenance expectations for GAI systems.”
NIST AI RMF 1.0, MEASURE 2.10
Not kept in the IDE; 28 days for other use, with listed exceptions
Access through IDE for Chat and Code Completions: Prompts and Suggestions: Not retained User Engagement Data: Kept for two years. Feedback Data: Stored for as long as needed for its intended purpose. All other GitHub Copilot access and use: Prompts and Suggestions: Retained for 28 days.
These are the default settings for Copilot Business and Enterprise customers. GitHub Copilot, frequently asked questions, kept 26 Oct 2026 · sha256 30826739dddc
Q4
Can a customer have the vendor keep none of its data?
NIST AI 600-1, action GV-6.1-004: “Draft and maintain well-defined contracts and service level agreements (SLAs) that specify content ownership, usage rights, quality standards, security requirements, and content provenance expectations for GAI systems.”
NIST AI RMF 1.0, MEASURE 2.10
Not published in the pages kept
Searched: GitHub Copilot, frequently asked questions; GitHub Subprocessors; Usage limits for GitHub Copilot.
Q5
Where does the vendor process and store customer data?
NIST AI 600-1, action GV-6.1-009: “Update and integrate due diligence processes for GAI acquisition and procurement vendor assessments to include intellectual property, data privacy …”
NIST AI RMF 1.0, GOVERN 6.1
Listed for each sub-processor; AI inference in the US and other countries
Google Cloud Platform (GCP) Cloud Hosted Infrastructure, AI Inference and AI Services United States, Belgium, Singapore
Each row of the list gives a “Location of Processing”. Fireworks AI lists “United States, Germany, Iceland”. GitHub Subprocessors, kept 26 Oct 2026 · sha256 fafcdb7003b5
Q6
Which other companies process customer data for the vendor?
NIST AI 600-1, action GV-6.1-007: “Inventory all third-party entities with access to organizational content and establish approved GAI technology and service provider lists.”
NIST AI RMF 1.0, GOVERN 6.1; NIST AI RMF 1.0, MANAGE 3.1
A published list; new names 30 days in advance
GitHub publishes the names of any new subprocessors for its online services at least 30 days in advance of the subprocessor’s authorization to perform services that may involve access to customer data or personal data.
GitHub Subprocessors, kept 26 Oct 2026 · sha256 fafcdb7003b5
Q7
Which independent audits or certifications does the vendor name?
NIST AI 600-1, Appendix A.1.3: “statement on standards for attestation engagement (SSAE) reports to help with third-party transparency and risk management for GAI systems”
NIST AI RMF 1.0, GOVERN 6.1
Not published in the pages kept
Searched: GitHub Copilot, frequently asked questions; GitHub Subprocessors; Usage limits for GitHub Copilot.
Q8
Does the vendor publish a history of its service incidents?
NIST AI 600-1, action GV-6.2-007: “Service Level Agreements (SLAs) in vendor contracts that address incident response, response times, and availability of critical support.”
NIST AI RMF 1.0, GOVERN 6.2
Yes: a status history feed, with 32 incidents kept since 2026-09-18
Status history feed, kept 1 Nov 2026 · sha256 dd5bc7c080dd. The record.
Q9
Does the vendor publish the dates on which it retires its models?
NIST AI 600-1, action GV-6.2-007: “Review vendor contracts and avoid arbitrary or capricious termination of critical GAI technologies or vendor services …”
NIST AI RMF 1.0, GOVERN 6.2
Not read
GitHub Copilot is an AI application; this site reads model retirement pages of model makers and clouds only.
- GitHub Copilot, GitHub Copilot, frequently asked questions, kept 26 Oct 2026.
- GitHub Copilot, GitHub Subprocessors, kept 26 Oct 2026.
- GitHub Copilot, Status history feed, kept 1 Nov 2026.
- NIST, NIST AI 600-1, 2024-07. Republished courtesy of the National Institute of Standards and Technology.