Copilot - Project Code Privacy - Concerns

[ajaythotacapita]

Select Topic Area

Question

Body

Hi Team,

We are happy to see how Copilot is helping the developers. But we have concerns before going to start using across organization. can you please clarify the below:

Our company is naturally concerned about data leaks and IPR.

Can you confirm if code we share with the AI/Copilot is used by the AI to learn? We are concerned that a competitor may be able to pose a question to the AI that could reveal details about our code and therefore out our IPR at risk.

[Akash1134]

Hi @ajaythotacapita ,

Thank you for showing interest in GitHub Copilot for your organisation.

GitHub Copilot for Business does not retain any Prompts or Suggestions. GitHub Copilot for Business relies on file content and additional data to work. It collects data to provide the service, some of which is then retained for further analysis and product improvements.

---

What data does Copilot for Business collect?

Copilot for Business processes data as described below:

Prompts
A Prompt is the contextual information the GitHub Copilot extension sends when a user is working on a file and pauses typing, or when the user opens the Copilot pane. Copilot for Business Prompts are only transmitted in real-time. Copilot for Business does not retain Prompts.

Suggestions
A Suggestion is one or more lines of proposed text returned to the GitHub Copilot extension after a Prompt is received and processed by the AI-model. Copilot for Business Suggestions are only transmitted in real-time. Copilot for Business does not retain Suggestions.

User Engagement Data
When you use GitHub Copilot it will collect User Engagement Data. This is usage information about events generated when interacting with the IDE or editor. These events include user edit actions like whether Suggestions are accepted or dismissed, and error and general usage data to identify metrics like latency and features engagement. This information may include personal data, such as pseudonymous identifiers.

---

How is the data in Copilot for Business used and shared?

User Engagement Data is used by GitHub and Microsoft to provide the service and to enable improvements. Such uses may include:

• Evaluating GitHub Copilot, e.g., by measuring the positive impact it has on the user
• Fine tuning ranking and sorting algorithms and Prompt crafting
• Detecting potential abuse of GitHub Copilot or violation of Acceptable Use Policies
• Conducting experiments and research related to developers and their use of developer tools and services

Source: GitHub Docs

[ajaythotacapita]

@Akash1134 - Thank you for answering the questions.
can you please bit more elaborate on GitHub Copilot for Business relies on file content and additional data to work.
The file means is it code file or entire code base?

we have concerns that copilot upload all the codebase to AI System and may use the same for other customers to give as suggestions?
can you please clarify how it works?

[Akash1134]

Hi @ajaythotacapita

GitHub Copilot for Business does not retain any Prompts or Suggestions - meaning none of your private data is used for training the AI model.

It uses the text in your IDE to provide better suggestions - GitHub Copilot for Business uses various elements of the context of your project to provide suggestions, including file content both in the file you are editing, as well as neighboring or related files within a project. It may also include the URLs of repositories or file paths to identify relevant context. The comments and code along with context are then used to synthesize and suggest individual lines and whole functions.

Thanks!

[ajaythotacapita]

Hi @Akash1134
Just to be clear, we want to ensure there are no IPR leaks before start using at our enterprise level.

Can you confirm that the data contained in the below extract from your response is not used to train the AI model.

“uses various elements of the context of your project to provide suggestions, including file content both in the file you are editing, as well as neighboring or related files within a project. It may also include the URLs of repositories or file paths to identify relevant context. The comments and code along with context are then used to synthesize and suggest individual lines and whole functions.”

[PrimevalCoder]

Hi, one of the Copilot Privacy FAQ states: "No. GitHub does not use either Copilot Business or Enterprise data to train its models."
Do these terms apply for Copilot Pro(+) plans as well, or just the Business plan? In other words, will the Pro(+) prompts, etc., be used to train the models?

[ajaythotacapita]

@Akash1134 and Team, can you please confirm on the question. we are waiting to make final decision to go for it or not. it will be based on your confirmation.

[Akash1134]

Hi @ajaythotacapita , Like I mentioned above, please be rest assured that the code you write with GitHub Copilot is never used for training purposes.

[Akash1134]

We've recently showcased GitHub Copilot Trust Centre to help enable developers and organizations to maximize their potential by prioritizing security, privacy, compliance, and transparency as we develop and iterate on GitHub Copilot.

Read more about it here

[michaelhoffmantech]

@Akash1134 is there a plan for a similar trust center with individuals? The trust center text is "mostly" specific to the Business plan. It would also help if there was an Individual privacy statement outlined, similar to the one for Business here: https://docs.github.com/en/site-policy/privacy-policies/github-copilot-for-business-privacy-statement