Skip to main content

Buyer guide

GitHub Copilot Data, IP & Content Exclusion Checklist

Terms, training and retention by plan, what IP indemnity requires since April 2026, content exclusion gaps, and cloud agent guardrails.

Reading time
4 min read
Sources
12 cited
In this piece
GitHub Copilot+11 Mixed

The call

Put everyone who works on company code on Business or Enterprise seats, update legal's indemnity notes to Microsoft's April 2026 terms, and keep the cloud agent firewall on.

Treat content exclusion as partial wherever engineers use agent mode in their editor, and stream the audit log to your SIEM before its 180-day window closes.

Copilot's data and IP protections hold only on Business or Enterprise seats and outside the places content exclusion skips. Personal Free, Pro and Pro+ accounts feed model training until each user opts out, and Copilot Chat's Edit and Agent modes ignore exclusion rules in VS Code and other editors. Security and legal teams settle these points before Copilot spreads, and each item cites the GitHub page that states it.

When you need this

  • Legal is reviewing Copilot Business or Enterprise terms, or a Microsoft agreement that includes Copilot.
  • Developers use personal Copilot Free, Pro, or Pro+ accounts on company code.
  • You rely on content exclusion to keep sensitive repositories or paths away from Copilot.
  • The cloud agent or third-party coding agents are about to be enabled.

Evaluation criteria

  1. Confirm which terms govern your purchase

    Did you buy Copilot from GitHub or through Microsoft?

    Look forFor Business or Enterprise bought from GitHub, read the GitHub Generative AI Services Terms. Microsoft purchases follow Microsoft's Product Terms. Other users follow Section J of the GitHub Terms of Service.

  2. Move company work onto company seats

    Which engineers use a personal plan on company code?

    Look forAssign Business or Enterprise seats to everyone working on company code. GitHub excludes those plans' data from model training. Free, Pro, and Pro+ interactions permit training unless users opt out. Joining Business or Enterprise cancels the user's individual plan.

  3. Record what each surface retains

    Which prompts and suggestions does GitHub keep, and for how long?

    Look forFor Business and Enterprise, GitHub does not retain IDE chat or completion prompts and suggestions. It keeps prompts and suggestions from other access, including GitHub.com chat, mobile, and Copilot CLI, for 28 days. Engagement data stays for two years.

  4. Check what IP indemnity requires now

    Is legal working from the current indemnity conditions?

    Look forMicrosoft's Customer Copyright Commitment page states that since April 3, 2026, GitHub offerings need no additional mitigations: the duplication detection filter is no longer required for coverage and stays available as an option. GitHub's plans page lists IP indemnity on none of the individual plans. Decide on the filter as a code-hygiene setting, and have an enterprise admin turn it on if you still want suggestions that match public GitHub code suppressed.

  5. Map where content exclusion applies

    Which surfaces ignore your exclusion rules?

    Look forDocument where content exclusion stops applying. Copilot Chat Edit and Agent modes ignore it in VS Code and other editors, and chat in Xcode and Eclipse ignores it too. Copilot CLI and the Copilot app now apply it to chat and agents, as do GitHub.com and GitHub Mobile (GitHub's content exclusion page). Exclusion skips symlinks and remote filesystems, and IDEs can still pass semantic information such as types from excluded files. Code review on GitHub.com respects exclusion.

  6. Fence the cloud agent

    What can the agent reach, and where can it push?

    Look forKeep the agent firewall on. Store secrets the agent must not see as Actions secrets. Configure agent secrets only where needed. Use GitHub-hosted or ephemeral runners and require code scanning through rulesets. Opt repositories out where agents should not work. The agent pushes only to its copilot/ branch or the pull request branch it was assigned.

  7. Know what the audit log covers

    Can you reconstruct who changed a policy and what an agent did?

    Look forSearch action:copilot in the audit log for policy and license changes, and actor:Copilot for agent activity on GitHub.com. The log keeps events for 180 days, so stream it to a SIEM for longer history. It omits prompts from local clients, so use hooks to send Copilot CLI events to your own logs when required. Cloud agent session logs stay on GitHub.com after the session ends, visible to everyone with repository access, and they can be archived but not deleted.

  8. Check data residency

    Must Copilot inference and data stay in one region?

    Look forOn GitHub Enterprise Cloud with data residency, set the policy to keep inference and associated data in the United States or European Union. Developers can then use only models certified for that region.

Questions to ask vendors

  1. Which of our agreements governs Copilot: the GitHub Generative AI Services Terms or Microsoft's Product Terms?
  2. When will content exclusion cover Edit and Agent modes in VS Code and chat in Xcode and Eclipse? GitHub's content exclusion page gives no date, so get one from your GitHub account team before you rely on exclusion in those editors.
  3. Which third-party coding agents can run in our repositories, and which data and retention terms apply to them?
  4. How long does GitHub keep cloud agent session logs, and how do we export them? GitHub's session data page states no retention period and no export, so ask your GitHub account team for both before agents work in repositories with sensitive code.

Red flags

  • Developers on personal Free, Pro, or Pro+ plans working in company repositories.
  • Content exclusion treated as complete protection while engineers use agent mode in their editor.
  • Indemnity terms read from pre-April 2026 guidance that still treats the public code filter as a condition of coverage.
  • The cloud agent's firewall disabled, or secrets available to agent sessions that do not need them.

Products in this piece

Sources

Official documentation
9
Public source
3
  1. GitHub Copilot plans & pricingOfficial documentationgithub.com
  2. GitHub docs: Terms for additional products (GitHub Copilot)Official documentationdocs.github.com
  3. Microsoft Learn: Customer Copyright Commitment required mitigations (GitHub change effective Apr 3, 2026)Public sourcelearn.microsoft.com
  4. GitHub Copilot docs: Content exclusionOfficial documentationdocs.github.com
  5. GitHub Copilot docs: Cloud agent risks and mitigationsOfficial documentationdocs.github.com
  6. GitHub Copilot docs: Building guardrails for the cloud agentOfficial documentationdocs.github.com
  7. GitHub Copilot docs: Policies for enterprises and organizationsOfficial documentationdocs.github.com
  8. GitHub Copilot docs: Reviewing audit logsOfficial documentationdocs.github.com
  9. GitHub docs: Copilot with data residencyOfficial documentationdocs.github.com
  10. GitHub Copilot docs: About GitHub Copilot session dataOfficial documentationdocs.github.com
  11. Hacker News: kevcampb on the 2026 interaction data policy (Mar 29, 2026)Public sourcenews.ycombinator.com
  12. Grégoire Dauré: Adopting GitHub Copilot at enterprise scale (Jan 15, 2026)Public sourcegdaure.io

Keep reading

  1. Buyer guideMoving Off Continue: A Migration ChecklistInventory a team's Continue setup and carry its models, rules, MCP servers, and prompts to a maintained tool, and run a pilot before removing Continue.
  2. Buyer guideGitHub Copilot Workflow PlaybookRepository instructions, agent-ready issues, and a review routine for cloud agent pull requests.
  3. Buyer guideGitHub Copilot AI Credit Budget & Policy ChecklistThe budget controls to set under AI credits, in GitHub's order, sized with GitHub's method, plus model and code review billing policy.
Read the research