Last checked:
Scorecard › Is GitHub Copilot safe for business?
Is GitHub Copilot safe for business?
Best-graded plan: GitHub Copilot Business / Enterprise (A). GitHub Copilot Business / Enterprise does not train on your data by default. GitHub Copilot Free / Pro / Pro+ can use your data for training unless you opt out.
| Plan | Grade | Trains by default | Human review | Retention | DPA | SOC 2 |
|---|---|---|---|---|---|---|
| Free / Pro / Pro+ | C | yes since Apr 24, 2026 (opt-out available) | unknown | unknown | no (DPA protection is for Business/Enterprise) | unknown |
| Business / Enterprise | A | no | unknown | IDE chat and code completions: prompts and suggestions not retained; other Copilot access (github.com, mobile, CLI): 28 days; engagement data 2 years | yes (GitHub Data Protection Agreement) | yes (SOC 2 Type II; Copilot Business and Enterprise in scope) |
Sources: Free / Pro / Pro+ · Business / Enterprise
C GitHub Copilot Free / Pro / Pro+
Since April 24, 2026, prompts, code snippets and context are used for training unless you opt out.
"if you have a Copilot Free, Copilot Pro, Copilot Pro+, or Copilot Max plan, GitHub may use your interactions ... to train and improve AI models."
A GitHub Copilot Business / Enterprise
No training on Business/Enterprise data, admin policies, GitHub's DPA, and Copilot Business/Enterprise are in GitHub's SOC 2 Type II report. Editor prompts aren't retained; other surfaces keep them 28 days.
"GitHub does not use Copilot Business or Copilot Enterprise customer data to train AI models."
Grades describe published policies, not security testing. How we grade.
More on GitHub Copilot