Is Github Copilot covered by the Data Protection Policy for Microsoft Copilot Enterprise Tenants?

[JonHinkerton]

Select Topic Area

Question

Copilot Feature Area

Copilot Enterprise

Body

Title covers the essence of the question. If my organization has a MS Copilot Tenant with data protections in place and I get a GH Coplot account with the same account, does the security umbrella extend to it? Are they truly separate products? Is the GH Copilot enterprise data protection agreement similar in scope and effect if they have to be purchased separately?

[LukasBel]

Microsoft Copilot vs GitHub Copilot: Data Protection Comparison

Overview

Microsoft Copilot and GitHub Copilot are separate products with different data protection frameworks, even when using the same account across both services.

Security & Data Protection

Microsoft 365 Copilot

• Protected by Enterprise Data Protection (EDP) under Microsoft's Data Protection Addendum (DPA)
• Microsoft acts as a data processor for organizational data
• Data inherits the same security controls as other Microsoft 365 products
• Subject to Microsoft's compliance commitments including GDPR and EU Data Boundary
• Prompts and responses not used to train foundation models

GitHub Copilot

• Covered by GitHub's own Data Protection Agreement (DPA)
• Different data handling practices than Microsoft 365 Copilot
• When purchased through Microsoft, falls under Microsoft Product Terms for GitHub Offerings
• Security approach varies by subscription tier (Individual, Business, Enterprise)
• Code context processing differs between editor environments and chat interfaces

Key Differences

Separate Agreements

The security umbrella does NOT automatically extend between products. Each has its own:

• Terms of service
• Data protection commitments
• Privacy policies
• Data handling practices

Data Processing

• Microsoft 365 Copilot: Processes organizational data with Microsoft acting as processor
• GitHub Copilot: Can collect code snippets and content for product improvement (depending on settings)

Purchase Route Impact

• Purchasing GitHub Copilot through Microsoft introduces additional protection through Microsoft Business & Services Agreement
• Direct GitHub purchase follows GitHub Customer Agreement with different terms

Recommendation

If security and data protection alignment between Copilot services is important to your organization:

1. Review both data protection agreements carefully
2. Consider purchasing GitHub Copilot through Microsoft for more consistent protection
3. Implement appropriate usage policies for both services
4. Evaluate GitHub Copilot Enterprise for the highest level of security controls

References

For detailed information, consult:

• Microsoft 365 Copilot Data Protection documentation
• GitHub Copilot Trust Center
• Microsoft Product Terms for GitHub Offerings
• GitHub DPA (Data Protection Agreement)

[lrpaula411-art]

Uploading TPL-202510-GitHubDataProtectionAgreement.pdf…