This guide summarizes GitHub’s privacy principles, core features that protect user data, and practical steps you can take to secure accounts and repositories.
Core privacy principles
GitHub defines four core privacy principles that shape product design and operational decisions:- Protect people — handle user data with care and safeguard integrity.
- Require trust, control, and transparency — provide clear controls and explain how data is used.
- Be contextual — respect that processing requirements depend on context and local privacy laws.
- Be by expectation — integrate privacy into product development from the start.
Key privacy features and controls
GitHub provides multiple layers of controls and practices to protect user data. These span account-level protections, repository permissions, data handling policies, and third-party integration controls.- Account-level controls — user-managed permissions, authentication settings, and account recovery options.
- Repository access — private/public repository settings, granular role-based access, and limited staff access.
- Data collection & processing — collection of necessary account details and lawful processing for service delivery.
- Third-party integrations — permission scopes, user consent flows, and auditability for apps.
Quick reference: privacy features and primary actions
Account and authentication
Strong account protections are foundational. Users and organizations should:- Enable two-factor authentication (2FA) for all accounts.
- Use unique, strong passwords or passkeys.
- Review and limit OAuth and personal access token scopes.
- Periodically remove stale access (users, tokens, and apps).
Private repositories and staff access
Repository owners control who can view and interact with repository content and metadata. GitHub’s internal access to private repositories is restricted and granted on a need-to-know basis (for example, troubleshooting or responding to legal requests). Audit logs and access controls help administrators monitor these events.
Data collection and use
GitHub collects account information necessary to provide and improve its services (for example, handle, email, and payment details). This collection supports account management, billing, security, and product improvements. GitHub documents what it collects and why in its privacy policies.
Third-party apps and integrations
When you authorize third-party apps or integrations, GitHub surfaces permission scopes and consent flows so you can control what data is shared. Periodic review of installed apps and OAuth tokens reduces exposure and helps prevent unwanted data access.Compliance and security posture
GitHub maintains compliance and layered security controls:- Regulatory compliance — GitHub adheres to GDPR and other applicable privacy laws and frameworks. For international data transfers, GitHub uses compliance mechanisms such as the EU–U.S. and Swiss–U.S. Data Privacy Frameworks.
- Security controls — administrative, technical, and physical measures protect user data against unauthorized access, with defense-in-depth across infrastructure and product layers.
Summary and continuous improvement
Privacy is treated as an ongoing commitment at GitHub, not a one-time setup. The privacy principles guide product design and operations, and GitHub continuously updates features and policies to address new risks and regulatory changes.
Practical steps you can take: enable two-factor authentication, review and tighten repository and organization permissions, audit third-party app access regularly, and consult GitHub’s privacy resources to stay current with policy changes.
Resources and further reading
- GitHub Privacy page — details on GitHub’s privacy policies and practices.
- GitHub Documentation — guidance on account, repository, and organization privacy settings.
- GitHub Trust Center — information on GitHub’s security, compliance, and privacy programs.
- For context on global frameworks: EU–U.S. Data Privacy Framework and Swiss–U.S. Data Privacy Framework.
