Vendor record · github.com
What GitHub promises about your data.
Where GitHub publishes its promises, how long it gives you when it adds a sub-processor, and what has changed.
- Where it publishes
GitHub lists its sub-processors at github.com/subprocessors. We last read it on October 15, 2026.
- What has changed
We've recorded no change to its sub-processor list or data processing agreement between August 31, 2026 and September 16, 2026. Subscribers hear about a change the morning we read it; the public record shows it 30 days later.
- Its window
When it adds a sub-processor, its clause at github.com/subprocessors (read October 9, 2026) gives you 30 days' notice.
- Window
- 30
- Sub-processors
- 30
- Pages
- 8
- Copies
- 46
days' notice when it adds a sub-processor
sub-processors named
pages we watch
dated copies of all its pages, since August 31, 2026
GitHub DPA
GitHub's data processing agreement is at github.com/dpa; we last read it on October 15, 2026. GitHub's sub-processor list gives 30 days' notice before a new sub-processor is engaged. Here is the clause, from our October 9, 2026 copy:
30
days' notice
“GitHub publishes the names of any new subprocessors for its online services at least 30 days in advance of the subprocessor’s authorization to perform services that may involve access to customer data or personal data.”
Found automatically and not yet checked by a person. The quote is exact, and the link goes to the source. Nothing here says whether the term is good or bad, only that GitHub published it.
github.com/subprocessors · read 2026-10-09 · fingerprint df4abe14535bc805…
GitHub sub-processors
GitHub publishes a sub-processor list at github.com/subprocessors; we last read it on October 15, 2026. It names 30 entries. The first 15, as the list prints them: Amazon Web Services Inc (AWS); Anthropic PBC; Cerebras Systems Inc.; Cloudflare; DataDome Solutions, Inc.; Elasticsearch, Inc.; Fastly; Fireworks AI; FullStory, Inc.; GitHub BV; GitHub Australia Pty Ltd; GitHub Canada ULC; GitHub Germany GmbH; GitHub India Pty Ltd; Google Cloud Platform (GCP); and 15 more in the full table below. The public record holds no change to the list read before September 16, 2026. A change we read after September 16, 2026 is published 30 days after we read it.
30 named · full table
Every public change we have recorded · Where vendors publish their lists
How long GitHub keeps your data
GitHub's terms of service (github.com/terms, in the copy read October 11, 2026) says: “Upon Cancellation](#2-upon-cancellation) We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements, but barring legal requirements, we will delete your full profile and the Content of your repositories within 90 days of cancellation or termination (though some information may remain in encrypted backups).”
Training on customer data
“You also grant GitHub and its Affiliates a license to collect and use your Inputs and Outputs to develop, train and improve artificial intelligence and machine learning models and technologies including those that power AI Features, unless (a) you opt out through your account settings, or (b) your use of the Service is governed by a GitHub Customer Agreement or volume licensing agreement.”
github.com/terms · read 2026-10-11
Training on customer data
“For the avoidance of doubt, use of Your Content to develop, train, and improve artificial intelligence and machine learning models and technologies of GitHub and our Affiliates is within the scope of this license and does not constitute a sale or other restricted transfer of Your Content. ### [5.”
github.com/terms · read 2026-10-11
Training on customer data
“License Grant to Us](#4-license-grant-to-us) You grant GitHub and our Affiliates the right to store, host, archive, parse, display, and make copies of Your Content as necessary to provide, develop, and improve the Service, including by training AI Features, and for the purpose of training, developing, and improving artificial intelligence and machine learning models and technologies of our Affili…”
github.com/terms · read 2026-10-11
Retention windows vendors publish · What vendors say about training
What the pages say
Read automatically from the pages below and shown as printed. A missing row is a gap in our reading, not proof it isn’t there.
Sub-processors named · 30 · 5 name an AI provider we list
Amazon Web Services Inc (AWS)
Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services
United States
Anthropic PBCAI · Anthropic
AI Inference and AI Services
United States
Cerebras Systems Inc.AI · Cerebras
AI Inference and AI Services
United States
Cloudflare
Content delivery service
United States
DataDome Solutions, Inc.
Security management
United States, France
Elasticsearch, Inc.
Cloud Hosted Infrastructure
United States
Fastly
Content delivery service
United States
Fireworks AIAI · Fireworks AI
AI Inference and AI Services
United States, Germany, Iceland
FullStory, Inc.
Customer support ticketing analysis
United States
GitHub BV
GitHub Subsidiary
Netherlands
GitHub Australia Pty Ltd
GitHub Subsidiary
Australia
GitHub Canada ULC
GitHub Subsidiary
Canada
GitHub Germany GmbH
GitHub Subsidiary
Germany
GitHub India Pty Ltd
GitHub Subsidiary
India
Google Cloud Platform (GCP)
Cloud Hosted Infrastructure, AI Inference and AI Services
United States, Belgium, Singapore
Hewlett-Packard Limited
Cloud Hosted Infrastructure
United States
LambdaTest
Cloud Hosted Infrastructure
United States
Microsoft (Azure)
Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services
United States, Canada, Chile, Mexico
Moveworks
Customer support ticketing analysis
United States
NexMo Inc (aka Vonage)
SMS notification provider for 2 Factor Authentication
United States
npm Inc
GitHub Subsidiary
United States
Obsidian Security
Security management
United States
OpenAIAI · OpenAI
AI Inference and AI Services
United States
Oracle America, Inc.
Cloud Hosted Infrastructure
United States
Pusher
Building and managing real-time infrastructure for web and mobile applications
United States
Semmle Inc
GitHub Subsidiary
United States
Tines Automation Inc.
Security management
United States
Twilio (SendGrid)
SMS notification provider for 2 Factor Authentication
United States
xAIAI · xAI
AI Inference and AI Services
United States
Zendesk
Customer support ticketing system
United States
Retirements announced · every vendor's retirements
undated
18 ](/deprecations/deprecations-rss/stargazers) [
undated
4 ](/deprecations/deprecations-rss/forks)
undated
🔔 An easy-to-consume RSS feed for model deprecations from the major AI providers
undated
Deprecations
undated
deprecations/deprecations-rss's past year of commit activity
undated
deprecations-rss
The pages' own stamps: Effective date 2026-04-27 · Updated 2025-10-14 · Updated 2023-01-15 · Updated 2021-05-07 · Updated 2026-10-15
The pages we watch
Every page we read, so you can check it. Each is re-read on a schedule, and we keep a dated copy when it changes.
Where we get nothing
What GitHub does not publish where we can read it
Of the 8 public pages we watch for GitHub, these give us nothing right now.
Trust and security
the page at that URL is not that document
github.com/trustBefore you conclude anything
This only means we couldn’t read it on a public page. GitHub may share it in its agreement, a trust portal, or with any customer who asks.
So treat it as a question to ask them: “Can you send your sub-processor list, and tell us when it changes?”
What this page doesn’t tell you
No score.
Nothing here rates GitHub. A short notice window is a contract term, not a criticism.
Public pages only.
Private notices and negotiated terms are invisible to us. Your agreement may say something different.
Wrong? Tell us.
Corrections are free, always. We reply within 2–3 business days.
How we read a page · The change log
Work at GitHub? With an email at github.com you can claim this record, suggest pages we should watch, and take a free copy of it. Claiming changes nothing we publish.
Is GitHub in your product? Hear the morning we read a change.
You get the lines that moved, in GitHub’s own words, and the date any window closes. No card. Nothing to cancel.