GitHub Copilot

The most widely deployed code assistant, and usually already sanctioned. That makes what it sends, rather than whether it is allowed, the question to ask.

What leaks through it

Surrounding file context travels with every suggestion request. Nobody types a secret into Copilot; the secret is simply in the file that happened to be open, and it goes with the completion.

• api.githubcopilot.com
• copilot-proxy.githubusercontent.com

Guardrails once it is inspected

Alectura intercepts only tools it has been tested against. Everything else is discovered, meaning you get the app, the devices running it and how often, but the content is never decrypted, so content rules cannot run on it yet.

Today GitHub Copilot is discovered: you get the app, the devices running it and how often, without decrypting anything. The rules below are the ones that apply to it, and they run once it is onboarded for inspection.

• BlockBlock private keysALC-002

  A PEM, SSH or PGP private key block in the context stops the request. A key in an open file is the single most common way one leaves a laptop.

• MaskNo secrets in inputALC-001

  Tokens in the surrounding lines are masked, so completions keep working on a file that happens to hold a credential.

• AlertInternal host / URL leakALC-005

  Internal hostnames, private IPs and staging URLs sitting in the code context that travels with every completion request.

Those are the ones worth spelling out for GitHub Copilot. All 27 rules in the catalog apply, and you can see the full catalog.

What happens to whatever gets through

Model training

Business and Enterprise code snippets are excluded from training by default. Individual plans expose a snippet-collection toggle that is the user’s to set.

Retention

Suggestions in the IDE are not retained; prompts sent through chat features are retained per the product-specific terms.

Data residency

US-hosted.

The vendor’s own controls

• ·Organization policy for snippet collection and public-code matching
• ·Content exclusion by repository or path
• ·Audit log for policy changes

Sources

• GitHub Copilot docs
• Copilot product-specific terms

Vendor terms last checked August 14, 2026, and summarised from GitHub’s published documentation. Confirm against the sources above before writing policy around this page.