GitHub Copilot and GDPR: How to Achieve EU Residency

GitHub Copilot is well on its way to becoming a standard tool in Swedish development. But for organizations with GDPR requirements, the default configuration falls well short: EU residency for Copilot requires a specific chain of choices – and the most important one is off by default.

The Starting Point: github.com Lives in the US

Regular github.com, where most organizations keep their repos, is hosted in US Azure regions. That applies to the code, the issues, and the Copilot traffic. For many organizations, that’s manageable with the right legal basis and transfer mechanism. But for organizations that require processing to happen in the EU, it’s the starting point itself that has to change. Even organizations that never made an active decision about a cloud provider have, in effect, already chosen the US simply by using github.com.

The Path to Residency: ghe.com and a New Organization

EU residency requires GitHub Enterprise Cloud with data residency, which runs on ghe.com instead of github.com. There’s no in-place upgrade: you need a new organization with Enterprise Managed Users (EMU), where identities are controlled from your own identity provider, followed by a migration of repos, permissions, CI workflows, and integrations.

Plan for a project, not a setting. Migrating development workflows affects the whole team’s daily work, so plan with a pilot group and a clear order for which repos move when. Also set a plan for what doesn’t move: older organizations often have years of issues, wikis, and CI history that need to be migrated, archived, or retired – and each category is its own decision.

The Trap: The Copilot Policy Is Off by Default

This is where most people go wrong. The residency tenant alone isn’t enough for Copilot: the policy that restricts Copilot to residency-compatible models is off by default. Without it, Copilot calls can be routed to models that process data outside the region – and then your code leaves the EU even though you’re paying for residency.

A scenario that shows the price: an organization moves to ghe.com, notes EU residency in its DPIA, and rolls out Copilot to 80 developers. Nobody enables the model policy. Every code suggestion for months has therefore been processed outside the region, and the deviation is only discovered at the next audit. The check itself takes minutes – the follow-up work of deviation reporting and reassessment takes considerably longer.

What Stays in the US – Regardless of Configuration

Even with a correctly configured residency tenant, certain flows are processed in the US:

• Telemetry – operational and usage data.
• Billing – account and payment flows.
• Secret scanning validation – the check on detected secrets.

A detail that surprises many: GitHub isn’t included in Microsoft’s EU Data Boundary, despite the ownership. These flows can’t be configured away – they need to go into your transfer documentation as remaining transfers, along with the corresponding assessment.

The Protections for Your Code

Two commitments are central to the contractual picture. On Business and Enterprise, GitHub doesn’t train on your code. And the Customer Copyright Commitment – the commitment under which GitHub and Microsoft take responsibility for copyright claims against Copilot-generated code – only applies if the content filters are active and public code matching is set to Block.

The table works as a minimum check before rollout – every row can be verified in the admin console or the contract, and every row has tripped someone else up before. The filters, incidentally, aren’t just a security detail but a condition for the indemnification protection – a disabled setting can cost you the entire commitment the day a claim lands.

Watch the Lists

Two things change on an ongoing basis: which models are residency-compatible in the EU, and the credit terms for premium usage. Check the current lists before rollout and at every major Copilot change, and date the check in your documentation. Assign an owner for Copilot governance who reads the changelogs, updates the policies, and can answer an auditor’s questions without archaeology.

Rolling out AI-assisted development in a regulated environment means governance is half the job. At Weapp, we work daily on development and integrations that include requirements like these – get in touch if you’d like a second opinion on your setup.