Tracker / Coding assistant

Does GitHub Copilot train on your code? GitHub Copilot admin guide

On individual plans, GitHub may use prompts, suggestions and code snippets to train models unless the user opts out. GitHub does not use Copilot Business or Enterprise data for training. You can allow the business endpoints and block the individual-plan endpoint at the firewall.

Vendor: GitHub (Microsoft) · Last checked Oct 22, 2026 · 3 plans tracked

Plan by plan

Free / Pro / Pro+ / Max (individual) consumer

Trains on your data?
Yes – opt-out GitHub may use interaction data (prompts, suggestions, code snippets) to train models. Users can opt out at github.com/settings/copilot/features. source ↗ checked Oct 22, 2026
Retention
Unknown Not verified from a vendor-owned source yet.
SSO
No The plans table lists SAML SSO as not included on individual plans. source ↗ checked Oct 22, 2026
SCIM
Unknown Not verified from a vendor-owned source yet.
Audit logs
No Copilot audit log events are documented for Copilot Business and Copilot Enterprise organizations/enterprises only. source ↗ checked Oct 22, 2026
Data residency
Unknown Not verified from a vendor-owned source yet.
DPA
Unknown Not verified from a vendor-owned source yet.

Business business

Trains on your data?
No GitHub does not use Copilot Business data to train its models. source ↗ checked Oct 22, 2026
Retention
IDE/CLI: not retained; other surfaces: up to 28 days Default for Business/Enterprise: IDE chat, code completions and Copilot CLI inputs/outputs are not retained; other Copilot access (e.g. github.com, mobile) up to 28 days. User engagement data kept 2 years. source ↗ checked Oct 22, 2026
SSO
Unknown Not verified from a vendor-owned source yet.
SCIM
Unknown Not verified from a vendor-owned source yet.
Audit logs
Yes Copilot events appear in the organization/enterprise audit log. source ↗ checked Oct 22, 2026
Data residency
US or EU – only with GHE.com (GitHub Enterprise Cloud with data residency) An enterprise policy keeps Copilot inference and associated data in the designated region; regions today: United States, European Union. source ↗ checked Oct 22, 2026
DPA
Yes Copilot bought directly from GitHub is governed by the Generative AI Services Terms (since 5 Mar 2026), which bind you to the GitHub Data Protection Agreement. source ↗ checked Oct 22, 2026

Enterprise enterprise

Trains on your data?
No GitHub does not use Copilot Enterprise data to train its models. source ↗ checked Oct 22, 2026
Retention
IDE/CLI: not retained; other surfaces: up to 28 days Default for Business/Enterprise: IDE chat, code completions and Copilot CLI inputs/outputs are not retained; other Copilot access (e.g. github.com, mobile) up to 28 days. User engagement data kept 2 years. source ↗ checked Oct 22, 2026
SSO
Unknown Not verified from a vendor-owned source yet.
SCIM
Unknown Not verified from a vendor-owned source yet.
Audit logs
Yes Copilot events appear in the organization/enterprise audit log. source ↗ checked Oct 22, 2026
Data residency
US or EU – only with GHE.com (GitHub Enterprise Cloud with data residency) An enterprise policy keeps Copilot inference and associated data in the designated region; regions today: United States, European Union. source ↗ checked Oct 22, 2026
DPA
Yes Copilot bought directly from GitHub is governed by the Generative AI Services Terms (since 5 Mar 2026), which bind you to the GitHub Data Protection Agreement. source ↗ checked Oct 22, 2026

How to block or allow GitHub Copilot

  1. network

    Allow business endpoints, block individual endpoint

    Allowlist *.business.githubcopilot.com (Business) and/or *.enterprise.githubcopilot.com (Enterprise). Blocklist *.individual.githubcopilot.com.

    source ↗ checked Oct 22, 2026

Domains

“Primary domain only” means we haven't found a full endpoint list from the vendor, so blocking just this domain may not catch every API or desktop-app endpoint.

Change history

Sources