Does GitHub Copilot keep data in Australia?
No Australian storage option. Copilot data and logs are stored outside Australia by default, even on GHE.com in Australia. In-region Copilot processing is offered only in the US and EU.
GitHub (Microsoft) · AI coding assistant · Plans covered: Copilot Business, Copilot Enterprise · Last checked
What GitHub (Microsoft) says
| Claim | Status | Vendor's words | Source | Last checked |
|---|---|---|---|---|
| Storage at rest | Not in Australia | Data and logs for GitHub Copilot, by default stored outside your region. If you enable the Restrict Copilot to data residency compliant models policy, inference, prompts, responses, logs, and telemetry remain in-region. Note: GitHub Enterprise Cloud with data residency (GHE.com) lists Australia as a region, and repository code and user data for an Australian enterprise are stored in Australia. Copilot data is a listed exception, stored outside the region by default. The policy that keeps it in-region is only offered in the US and EU (see processing), so an Australian enterprise cannot currently keep Copilot data in Australia. For enterprises on GitHub.com (not GHE.com), GitHub says "By default, GitHub stores data for GitHub.com in the USA." | docs.github.com | |
| Processing (incl. AI inference) | Not in Australia | Copilot with data residency is currently available in the following regions: Note: The list is United States and European Union; Australia is not listed. The page says "GitHub plans to add support for more regions in the near future." GitHub's 13 April 2026 changelog says "Additional Proxima regions (e.g., Japan and Australia) are on the roadmap for later in 2026." No date is given. Models are hosted by OpenAI and GitHub's Azure infrastructure (OpenAI models), Amazon Web Services, Anthropic PBC and Google Cloud Platform (Anthropic models), Google Cloud Platform (Gemini), xAI (Grok) and Azure in GitHub's tenant (Microsoft MAI-Code). The model hosting page does not say which countries these providers process Copilot requests in. | docs.github.com | |
| Support access | Not published | GitHub Support will never access your private repositories without your explicit consent. Note: GitHub does not say where support staff are located or access data from. The storage page lists "Support and feedback data" (support requests, phone conversations, chat and remote assistance sessions) as data that may be stored outside your chosen region. Repository access by support needs the owner to accept a temporary access request, and the support page says all support staff access generates audit log events. | docs.github.com | |
| Plan required | Paid option | Your developers can access GitHub Copilot if you grant them access to a Copilot Business or Copilot Enterprise subscription. Note: Australian storage of code and repositories needs GitHub Enterprise Cloud with data residency (the GitHub Enterprise plan), and Copilot on GHE.com needs a Copilot Business or Enterprise seat. Managed users cannot buy Copilot Individual. No plan gives Australian processing for Copilot today, and neither plan keeps Copilot data stored in Australia. Where the in-region policy is offered (US, EU), GitHub says requests cost 10% more AI credits. | docs.github.com | |
| Exclusions | Partly | Although your code and user data are stored within your chosen region, GitHub may store certain types of data outside your region, and may need to transfer some data outside your region. Note: Listed as possibly stored outside the region: telemetry or logs with consistent identifiers tied to a person; information needed to administer a paid plan (contact, billing, licence); support and feedback data; GitHub Copilot data (by default); secret scanning validity and extended metadata check data, if enabled. The page also says "GitHub will document reasons for the transfer of data out of your enterprise's region, but does not notify you when transfers occur." TLS certificate details for the GHE.com subdomain go to certificate authorities and certificate transparency logs, some of which may be outside the region. | docs.github.com | |
| IRAP status | Not published | The vendor does not publish a statement on this. Note: GitHub's list of compliance reports (SOC 1 and 2, CSA CAIQ and STAR, ISO/IEC 27001, PCI DSS and others) does not include IRAP. Microsoft's IRAP page lists Azure, Dynamics 365, Microsoft Managed Desktop, Office 365 and Windows 365 as in scope, and does not name GitHub or GitHub Copilot. | docs.github.com |
Why it matters
General information, not a compliance ruling.
- APP 8
- APP 8: sending personal information overseas, including remote access, can be a cross-border disclosure → see storage, processing, support access. Relies on: Storage at rest, Processing (incl. AI inference), Support access
- ISM-1572
- ISM-1572: contract must record processing and storage regions → see storage + processing. Relies on: Storage at rest, Processing (incl. AI inference)
- APRA CPS 230
- CPS 230: offshoring with a material service provider must be assessed and notified to APRA → see storage, processing, support access, exclusions. Relies on: Storage at rest, Processing (incl. AI inference), Support access, Exclusions
- OVIC IPP 9
- IPP 9 (Victoria): personal information may leave Victoria only in set circumstances → see storage, processing, support access. Relies on: Storage at rest, Processing (incl. AI inference), Support access
Changelog
No changes recorded yet.