GitHub

GitHub's privacy statement says the company stores and processes personal data in various locations, including the user's local region, the United States, and other countries where GitHub or its subprocessors operate. GitHub is a wholly owned subsidiary of Microsoft, a US company, and relies on standard contractual clauses and the Data Privacy Framework for EU transfers instead of storing EU data exclusively in the EU. This leaves account and repository data subject to US government access requests under the CLOUD Act.

Git data and other repository content are encrypted at rest by default using AES-256, and traffic is protected in transit with TLS 1.2 or higher, according to GitHub's engineering documentation. There is no end-to-end encryption. GitHub and anyone who obtains a valid decryption key through legal process can access stored content in plain form.

GitHub denies selling personal data, but its CCPA-required California disclosures admit sharing identifiers, internet/network activity, and inferences with ad networks, analytics providers, and social networks for marketing and advertising. This is individual-level behavioral sharing for advertising, not just aggregated analytics.

GitHub Copilot for individual subscribers (Free, Pro, Pro+, Max) uses prompts, suggestions, and code snippets from sessions to train and improve its models by default. Users can opt out anytime from their Copilot settings. Business and Enterprise customers are excluded from model training by default.

GitHub's core hosted platform is closed source and proprietary. Its terms of service prohibit duplicating or reusing its interface code. No source is published for the service running github.com. GitHub open-sources individual developer tools, such as the GitHub CLI and the Primer design system, but the hosted platform itself is not inspectable or forkable.

GitHub commissions recurring independent SOC 1, SOC 2 Type II, and SOC 3 audits covering GitHub Enterprise Cloud and Copilot Business and Enterprise, as well as ISO 27001 certification. The SOC 3 report is a general-use report for public distribution. Unlike the restricted SOC 2 report, it is published openly rather than gated behind an enterprise account.

GitHub's core hosted platform is closed source with no published governance model, maintainer structure, or community decision-making process. Development is directed entirely by GitHub and Microsoft staff. This is separate from the governance of the many open-source projects GitHub hosts, which is unrelated to the platform itself.

GitHub's Team and Enterprise tiers use metered, per-license billing. GitHub's own billing documentation confirms self-serve customers are charged monthly for the number of licenses used, on a fixed monthly billing period and recurring monthly billing date, not upfront annual payment. The listed rates, $4/user/month for Team and $21/user/month for Enterprise, are genuine monthly per-seat prices, footnoted on the pricing page as introductory rates "for the first 12 months" (implying an increase after a year) rather than an annual-billing-derived monthly-equivalent figure. A discounted annual prepay option exists but is not the headline price shown to buyers. A permanently free tier remains available for individuals and small teams.

GitHub Free includes unlimited public and private repositories with no feature gate blocking core version control, issues, or pull requests. This free tier is part of the same account whose behavioral data GitHub shares with advertising and analytics partners, so it does not meet the stricter "monetization-free" bar for full marks.

GitHub's plan comparison table clearly lists what each tier includes. But canceling the separate Git LFS data pack add-on is a recurring, corroborated pain point: at least four independent GitHub Community threads spanning September 2023 to April 2025 report the billing portal showing only an "Upgrade" button with no visible way to cancel or downgrade, forcing users to open a support ticket, with some reporting continued charges after failing to self-cancel. GitHub's own downgrade documentation covers account-level plan changes but does not mention Git LFS data packs at all. This is friction on a narrow billing add-on, not manipulation of the core paid-tier pricing, so it falls short of a full dark-pattern verdict.

GitHub charges the same USD-denominated per-seat price everywhere. No regional or purchasing-power-based pricing adjustment appears on the pricing page or in GitHub's billing documentation.

Every repository can be fully cloned with git clone, reproducing the entire commit history, branches, and file contents in the standard open Git object format. Beyond repository code, users can request a full personal account archive (Settings → account data export), which GitHub's own migration format documents as covering issues, comments, pull requests, reviews, releases, projects, and uploaded attachments as JSON alongside the repositories' Git data — not just account/profile metadata.

GitHub Enterprise Server is a feature-complete, self-hosted edition distributed as a virtual appliance that customers deploy on their own infrastructure, such as on-premises hypervisors like VMware ESXi or Hyper-V, or a private cloud. This gives organizations control over where their code and data reside. It requires operating a server yourself, so it is full self-hosting rather than a fully local, serverless product.

Git's core version control—commits, branches, history, diffs—works entirely offline once a repository is cloned, syncing with GitHub's servers only on push or pull because Git is a distributed version control system. GitHub's web features, including Issues, Pull Requests, Actions, and the web-based editor, require an active connection to github.com.

GitHub is available on the web, Windows, macOS, iOS, and Android. The official GitHub CLI runs natively on Linux, giving Linux users full access to the platform's core functionality even though the optional GitHub Desktop GUI client does not officially support it.

GitHub publishes per-product accessibility conformance reports against WCAG 2.1 and 2.2 Level AA using the industry-standard VPAT template, covering github.com, GitHub Desktop, GitHub CLI, and Copilot surfaces individually, and maintains dedicated documentation for using repositories and pull requests with a screen reader.

GitHub has operated as a wholly owned subsidiary of Microsoft since Microsoft's $7.5 billion acquisition in October 2018, placing it under one of the world's largest technology companies.

Ownership has not changed since Microsoft's 2018 acquisition; there has been no sale, merger, or corporate restructuring of GitHub in the past three years.

GitHub's Acceptable Use Policies set public rules against harassment, spam, and abusive advertising on the platform. Separately, GitHub applies Microsoft's Responsible AI Standard to Copilot. It publishes per-feature transparency documentation and conducts red-team testing before release. But this framework sits alongside an unresolved, direct challenge to the underlying practice: Doe v. GitHub, an ongoing suit alleging Copilot's training on public code violates the license terms under which that code was published. A live, unresolved dispute over whether the stated policy is actually honored in practice is a real gap, not just a caveat.

GitHub's infrastructure runs substantially on Microsoft Azure. Microsoft publishes an annual Environmental Sustainability Report detailing its public commitment to be carbon-negative, water-positive, and zero-waste by 2030. It has also disclosed that its emissions have risen 23.4% cumulatively since that pledge, driven largely by growth in cloud and AI infrastructure.

GitHub launched publicly in April 2008 and has been continuously developed for 18 years, including under Microsoft's ownership since 2018.

GitHub reports roughly 150 million developers and over 1 billion repositories as of 2025, with ongoing feature releases, an active public changelog, and a large body of open-source projects built on the platform.