Vendor profile
GitHub: where is customer data stored and processed?
GitHub stores customer data in the USA, Canada, Chile and Mexico, with the storage locations documented in the sub-processor list and the data processing agreement (DPA) under section 7.B, which refers to the EU-US Data Privacy Framework (DPF) and Standard Contractual Clauses (SCC). Processing also takes place in Belgium, Singapore and the USA, and AI inference runs in Germany, Iceland, Belgium, Singapore, Canada, Chile, Mexico and the USA. For customers with data residency, Copilot is listed as holding data in the USA or in an EU/EFTA region, but this is not confirmed. Login uses NexMo (Vonage) for SMS two-factor authentication in the USA, and support tools (Zendesk and FullStory) are also in the USA, with Microsoft Technical Services in several countries.
Checked 13 October 2026 · based on the vendor's own public documents
See the map and sources
Where data is stored and processed
| Activity | In the EU/EEA | Outside the EU/EEA |
|---|
| Storage | – | USA, Canada, Chile, Mexico |
|---|
| Processing | Belgium | USA, Singapore, Canada, Chile, Mexico |
|---|
| Login and user account | – | –
Only for customers in other regions: USA |
|---|
| Logs and telemetry | France | USA |
|---|
| Notifications and email | – | USA |
|---|
| Support | France, Norway, Spain, Sweden | USA, Canada, Brazil, Japan, Australia, Switzerland, United Kingdom |
|---|
| Group companies | Netherlands, Germany | Australia, Canada, India, USA |
|---|
| AI features | Germany, Iceland, Belgium, Europe (country not stated) | USA, Singapore, Canada, Chile, Mexico |
|---|
Only outside the EU/EEA, with no European alternative stated: Storage, Notifications and email.
Ownership and agreements
| Owner | MICROSOFT CORPORATION (USA) |
|---|
| Headquarters | USA |
|---|
| Data processing agreement | Found and read |
|---|
| Certifications | SOC 1, SOC 2, ISO/IEC 27001 |
|---|
Sub-processors (31)
| Name | Country | Purpose |
|---|
| Amazon Web Services Inc (AWS) | USA | Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services |
| Anthropic PBC | USA | AI Inference and AI Services |
| Cerebras Systems Inc. | USA | AI Inference and AI Services |
| Cloudflare | USA | Content delivery service |
| DataDome Solutions, Inc. | USA, Frankrike | Security management |
| Elasticsearch, Inc. | USA | Cloud Hosted Infrastructure |
| Fastly | USA | Content delivery service |
| Fireworks AI | USA, Tyskland, Island | AI Inference and AI Services |
| FullStory, Inc. | USA | Customer support ticketing analysis |
| Google Cloud Platform (GCP) | USA, Belgia, Singapore | Cloud Hosted Infrastructure, AI Inference and AI Services |
| Hewlett-Packard Limited | USA | Cloud Hosted Infrastructure |
| LambdaTest | USA | Cloud Hosted Infrastructure |
| Microsoft (Azure) | USA, Canada, Chile, Mexico | Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services |
| Microsoft | USA, Australia, Brasil, Canada, Frankrik | Technical Services |
| Moveworks | USA | Customer support ticketing analysis |
Sources