Shadow AI · Tool risk profile

GitHub Copilot.

by GitHub · coding · Verified April 19, 2026

Vendor site

Base risk

2.8/ 5

LowMediumHighCritical

GitHub Copilot Individual and Pro tiers may use prompts and suggestions to improve the model; Copilot Business and Enterprise contractually exclude training and add IP indemnification, audit logs, and content filtering. Risk concentrates on copyright (suggestions occasionally reproduce GPL code verbatim) and on accidental disclosure of secrets in source files; both are reduced by Business+ tier filters.

Tier comparison

Same logo. Very different risks.

  • Free

    medium
    Trains on inputs
    Yes
    Retention
    0 days
    SSO
    No
    Admin controls
    No

  • Paid · consumer

    medium
    Trains on inputs
    Yes
    Retention
    0 days
    SSO
    No
    Admin controls
    No

  • Enterprise · team

    low
    Trains on inputs
    No
    Retention
    0 days
    SSO
    Yes
    Admin controls
    Yes

FAQ

Questions teams ask about GitHub Copilot.

Does Copilot leak secrets to GitHub?

Telemetry is disabled on Business+ tiers. On Individual, prompts are processed by Microsoft/OpenAI but suggestions are not retained. Use a secrets scanner to be sure.

What about the IP indemnity?

Copilot Business and Enterprise include indemnification against third-party copyright claims when the duplicate-code filter is enabled.

Audit your shadow AI

Is GitHub Copilot live in your org
alongside tools IT doesn’t know about?

Run a free 12-minute audit to surface every shadow AI tool on your network, score the risk, and walk away with a block-list your IT team can import.

Start the free auditMethodology

Buzzi.ai publishes tool risk profiles for informational purposes only. Always validate terms with the vendor before operational decisions.