GitHub

github.com · facts updated 2 hours ago

Privacy facts at a glance

Jurisdictions: US · CA · BE · SG · IS · DE · AU · BR · FR · JP · NO · ES · SE · CH · GB · NL · IN
Subprocessors: 30
Retention: The privacy statement references a 'Security and Retention' section but no specific retention period in days is stated in the excerpts provided.
Transfer mechanism: Data Privacy Framework (DPF) is mentioned; SCCs referenced via DPA but no specific SCC modules stated in excerpts.
DPA available: Yes
GDPR addressed: Yes
CCPA addressed: Yes

Named subprocessors

Amazon Web Services Inc (AWS) Anthropic PBC Cloudflare Elasticsearch, Inc. Fastly Fireworks AI FullStory, Inc. Google Cloud Platform (GCP) Microsoft (Azure) OpenAI Zendesk xAI

Tracked documents

https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement checked 2 hours ago

https://docs.github.com/en/site-policy/github-terms/github-terms-of-service checked 2 hours ago

Data processing agreement

https://github.com/dpa checked 2 hours ago

Subprocessor list

https://docs.github.com/en/site-policy/privacy-policies/github-subprocessors checked 2 hours ago

Security / trust page

https://github.com/trust-center checked 3 hours ago

Recent changes

major Data processing agreement 2 hours ago

GitHub's DPA removed 'GitHub Spark' and 'GitHub Models' as listed services and added 'GitHub Copilot appDirect agents' as a listed service.

Public summary; per-account review history visible to subscribers tracking this vendor.

Track GitHub in your workspace.

Get notified when GitHub adds a subprocessor, changes retention, updates their DPA, or quietly amends their privacy posture.

Start tracking — 14-day trial

No card required.