GitHub’s Trust Center answers the hard questions about Copilot

GitHub Copilot went from technical preview to the first widely adopted generative AI coding tool between 2021 and 2022. As adoption spreads, GitHub’s own survey data shows that 92% of U.S.-based developers already use AI coding tools at work or on their own time. That reality means most organizations are already dealing with AI-generated code, whether or not they have formal policies around it. To close that gap, GitHub has launched the GitHub Copilot Trust Center, a single reference point for questions about privacy, security, compliance, and intellectual property.

The Trust Center is designed for enterprise teams that need to understand how Copilot actually works before they can responsibly equip developers with it. The questions it addresses are practical: what data is collected and retained, how suggestions are generated, and what safeguards exist to prevent insecure or problematic code from being proposed.

What organizations will find in the Trust Center

Enterprise adoption tends to stall when teams can’t get clear answers about a tool’s inner workings. The Trust Center is structured around those categories of concern, covering threats and policies across five key areas:

  • Security: explaining how Copilot removes sensitive information, blocks insecure coding patterns, and detects vulnerable patterns in incomplete code fragments.
  • Privacy: detailing what personal data is collected, how long it is retained, and how it gets used.
  • IP and open source: covering safeguards such as filtering mechanisms that aim to mitigate IP and open source concerns.
  • Accessibility: documenting the standards GitHub follows when designing products.
  • Labor market: sharing research on how Copilot affects developer productivity and the barrier to entry in software development.

Data handling under the hood

For Copilot for Business, GitHub collects three kinds of personal data: user engagement data, prompts, and suggestions. User engagement data is generated by events that occur while a developer iterates in a code editor. A prompt is the compilation of IDE code and relevant context—comments and code in open files—that the extension sends to the AI model. A suggestion is the one or more lines of proposed code returned to the extension after the model processes a prompt.

One of the most frequent misconceptions concerns where suggestions come from. Copilot’s output is not copied from a code database; each response is generated via probabilistic reasoning about what is likely to come next in a given coding sequence. Prompts are transmitted to the AI model in real time only to generate suggestions, then deleted. GitHub also runs several scans on prompts to identify and strip out certain sensitive information before they reach the model.

Training data usage is another point of distinction between tiers. Copilot for Business does not use your code to train the underlying Azure OpenAI model. Individual Copilot users, on the other hand, may opt in and explicitly consent to having their code used as training data. User engagement data from Business plans is used internally to fine-tune ranking, sort algorithms, and prompt crafting to improve service performance.

A pragmatic path for AI policy

The broader GitHub ecosystem still plays a role after suggestions are accepted. GitHub points enterprise users to its Advanced Security features—including code scanning, secret scanning, and dependency management—to close out the rest of the software development lifecycle.

GitHub’s aim with the Trust Center is to give compliance, security, and engineering leaders a clear basis for AI policies without forcing them to interpret a regulatory landscape that is still settling. Developers get to keep the productivity gains of AI-assisted work while having a transparent framework around what the tool captures and why.