A developer opens a private repository and asks Copilot to explain a proprietary pricing rule. The team is comfortable because the request stayed inside the IDE, but an IDE user interface is not proof that processing was entirely local. Another engineer worries that every file in the whole repository must be uploaded. Neither conclusion follows automatically. To assess the privacy risk, first identify the precise Copilot surface, account plan, policy, context supplied, model-processing path and intended retention behavior.<\/p>\n
The GH-300 August 2026 guide<\/a> includes data handling, input processing, prompt building, filtering, output post-processing, and limitations. GitHub’s product documentation is the place to verify current plan-specific behavior; a blanket statement about all users and all features will quickly become inaccurate. Architecture and privacy form one decision, because making a tool more powerful may change what it can access and what evidence it creates.<\/p>\n A prompt can contain text typed by a user, selected code, surrounding editor context, and material retrieved by a permitted tool. The service may process that context to construct a request to a model and may apply filtering before or after response generation. The output might be an inline suggestion, a chat response, proposed source-code edits, or a code-review comment. Those products can differ in the exact data they use.<\/p>\n Draw a data-flow diagram with sources, recipients and boundaries. A developer reviewing a single SQL query does not necessarily need a repository-wide search. A cloud agent working on a bug may encounter issue text, file contents and tool output. Label which values are confidential, who can approve access, and which system records the activity.<\/p>\n Training use depends on subscription and policy. GitHub explains that it does not use Copilot Business and Enterprise customer data to train its models under its documented policy, while terms for individual plans can differ and may include opt-out settings. Hosting partners and model choices can add relevant processing conditions. Do not convert one plan's protection into a universal claim about every feature or account.<\/p>\n Before approving usage for a regulated repository, review current GitHub policy and the organization’s contract rather than a community forum summary. If the team’s handling requirements forbid sending a particular file to a model, treat that as an access constraint even if the resulting code would be useful. The safest flow is to remove or redact unneeded confidential input at the source.<\/p>\n GitHub Copilot supports controls related to suggestions that match public code, depending on product and configuration. A filter may help identify or restrict certain matching suggestions, but it is not a universal legal or originality guarantee. Generated code can raise license, attribution, trade-secret, patent, or dependency concerns that require separate review. Exact behavior can also vary by surface.<\/p>\n If a suggested algorithm resembles an external project, examine its source and licensing before copying it into a proprietary codebase. A human should decide whether the use is permitted and whether an independently developed implementation is preferable. The software lifecycle and review discipline<\/a> remains relevant whether a snippet was generated, found online, or written manually.<\/p>\n Code comments, tests, pasted stack traces, issue descriptions and tool results can all carry untrusted text. An attacker may hide an instruction that tries to make an agent reveal secrets or send data to an external location. The correct boundary is to treat encountered content as task data unless a trusted user or policy explicitly authorizes an action.<\/p>\n A diagnostic log may also contain tokens in URLs or headers. Remove them before providing it as context. Storing sensitive content in a chat transcript can create a second copy governed by different retention and access rules. The AI prompt-injection security guide<\/a> extends this scenario to tool output and downstream actions.<\/p>\n A statement that information is encrypted in transit does not answer whether it is retained. A statement about training does not answer what appears in audit logs, who can read a chat transcript, or whether a connected tool can reach a private repository. Ask the separate questions: where data goes, how long it remains, what it is used for, which administrators can see related records, and what deletion or access controls apply.<\/p>\nMap input, augmentation and output separately<\/h2>\n
Interpret model-training statements precisely<\/h2>\n
Understand public-code matching as a specific safeguard<\/h2>\n
Avoid prompt injection and accidental data propagation<\/h2>\n
Distinguish retention, transport, and model use<\/h2>\n