GitHub
GitHub, Inc., owned by Microsoft Corporation since 2018 ·github.com· As of: 2026-07-30
Work through this tool with an AI
Our verdict
Source control creates no edge. No customer buys because the code is versioned cleanly. Without it, though, there is no company, only a set of machines on which somebody once saved something. What matters about this category for the guiding question of this collection is not the function but the ownership: anyone who builds for themselves has to know who owns the place the work sits in, and what it costs to leave it. With GitHub the answer splits in two. The code itself is never captive, because every clone holds the full history. Everything around it is.
Evidence:Plans, per-user prices, included build minutes and package storageOpen source25 named third parties and 7 group companies, 30 days notice, binding to the protection level of the data protection agreementOpen sourceEU storage only on the Enterprise plan on ghe.com, centrally managed user accounts, no public repositoriesOpen sourceGeneral availability of EU data residency on 29 October 2024Open sourceUse of interaction data from the personal Copilot plans for training from 24 April 2026, with an opt-outOpen sourceAudit log for 180 days, Git events for 7 days, streaming with a seven-day bufferOpen sourceAcquisition by Microsoft for 7.5 billion US dollars in stock, announced on 4 June 2018Open sourceChief executive stepping down at the end of 2025, with no named successorOpen source
Who it fits
Solo
suitable
The free plan includes unlimited private repositories, 2,000 build minutes and 500 MB of package storage a month. For a single person that is not a ceiling but plenty of room.
Mid-market
suitable
Four US dollars per user per month is predictable. The ceiling is not the seat price but consumption: the 3,000 included minutes go quickly once every push triggers a full check pipeline.
Enterprise
suitable with caveats
EU storage exists only as a separate environment on the Enterprise plan under its own subdomain. There, user accounts are centrally managed, public repositories are not available, and some features are missing. Anyone running open projects who also has to store data in the EU cannot have both in one account.
Buy, switch or build
Off-the-shelf
The house vendor's own workshop
Anyone already inside an ecosystem has usually paid for source control already: the Atlassian forge in an Atlassian shop, the in-house development platform in a Microsoft shop. That is pragmatic, and it sits on the same directory service and the same issue tracker. The price is the hiring position. Developers know the market leader's workflows, and a forge nobody outside the building knows costs time at every onboarding. On top of that, these products rarely sit in the front row when investment is allocated.
AI-native
No AI-native replacement, but a shifted load
There is no AI-native forge replacing this category, and none is to be expected, because the job is versioning and rule sets. What changes is the load. Assistants and agents sit on top of the repository and hand in their work as a pull request, so machines produce more changes than humans can review. The bottleneck moves from writing to reviewing. That is not a vendor question but a question of the rules inside the forge: mandatory review, automated check pipelines, and provenance for machine-generated changes.
Build it yourself
Running your own forge
Running your own forge is possible and not exotic. The lean open-source options run on a small server; the heavier open-source alternative brings check pipelines and security scanning with it. The licence costs nothing, the operation does: backup, availability, upgrades, directory integration, being on call. This route works under hard sovereignty requirements and in organisations that run servers anyway. What does not work is falling back to plain Git over SSH with no interface: that loses review, issues and build runs, which is exactly what the forge is for.
Our advice
- Solo: Free plan. Anything else is busywork.
- Mid-market: Buy. Before rolling out Copilot, treat the plan choice as a data protection decision, not a pricing one.
- Enterprise: Buy, but cost out EU residency first, including the features that are missing there.
Who is behind it
Staying power: Established
It is not the vendor that carries this, it is the owner. GitHub has belonged to Microsoft since 2018 and, since its chief executive stepped down at the end of 2025, is no longer run as a separate company with a leader of its own. GitHub publishes no revenue or profit figures for itself. That is a very solid position, and at the same time one in which you read the product's direction off the parent group's strategy rather than off the vendor.
- Ownership: Microsoft, acquired for 7.5 billion US dollars in stock, announced on 4 June 2018 and closed on 26 October 2018Acquisition by Microsoft for 7.5 billion US dollars in stock, announced on 4 June 2018Open source · As of 2026-07-30
- Leadership: Chief executive Thomas Dohmke announced in August 2025 that he would leave at the end of the year; no successor was named, and the leadership team reports into Microsoft's CoreAI organisationChief executive stepping down at the end of 2025, with no named successorOpen source · As of 2026-07-30
- Standalone financials: not published; GitHub is absorbed into the parent group's reporting · no source given · As of 2026-07-30
- Maintenance of the subprocessor list: public list naming 25 third parties and 7 group companies; new entries are published at least 30 days before authorisation25 named third parties and 7 group companies, 30 days notice, binding to the protection level of the data protection agreementOpen source · As of 2026-07-30
- EU data residency: generally available since 29 October 2024, first for the EU, later for the US, Australia and JapanGeneral availability of EU data residency on 29 October 2024Open source · As of 2026-07-30
Cost of leaving: Moderate
The code is never captive. Git is distributed, every clone holds the full history, and moving it elsewhere costs one command. What is captive is everything around it: issues, pull requests with their review comments, build runs, packages and the installed apps. There is an API and a migration tool for that, but no format another vendor reads in. The second point weighs more: the server software is not open source. A self-hostable edition exists, but it is a licensed proprietary product from the same maker. Moving from the managed service to running it yourself means, here, staying with the same vendor.
Regulation and data
| Data processing agreementdocumented, no condition attached: Auftragsverarbeitungsvertrag öffentlich abrufbar und ohne weitere Bedingung Bestandteil des Vertrags; oder er entfällt nachvollziehbar begründet, weil kein Anbieter Kundendaten verarbeitet.documented, tied to a condition: Vertrag existiert, ist aber an einen Tarif gebunden, nur nach Anfrage einsehbar oder allein in den Nutzungsbedingungen geregelt statt als eigenes Dokument.documented, but unfavourable: Kein Auftragsverarbeitungsvertrag im üblichen Sinn: entweder weil der Anbieter für das Kerngeschäft eigenständig Verantwortlicher ist und stattdessen eine andere Konstruktion gilt, oder weil öffentlich offen bleibt, ob überhaupt einer angeboten wird.open on a point that decides usability: Weder ein Vertrag noch ein dokumentierter Weg zu einem Vertrag; der Einkauf hätte nichts, worauf er sich stützen kann. | documented, no condition attachedIn place, as a separate document for enterprise customers; subprocessors are expressly bound to it25 named third parties and 7 group companies, 30 days notice, binding to the protection level of the data protection agreementOpen sourceThe subprocessor page states that every third party receiving personal data has signed a written agreement no less protective than the vendor's own data protection agreement. The document is public, but self-serve customers do not sign it separately.As of 2026-07-30 |
|---|---|
| Storage locationdocumented, no condition attached: EU-Speicherort ohne Zusatzkosten und ohne Tarifbindung, oder der Ort ist vollständig selbst bestimmbar, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: EU-Speicherort möglich, aber an einen Tarif, einen gesondert zu aktivierenden Zusatz oder einen Umzug in eine getrennte Umgebung gebunden; oder die EU-Region ist nicht die Voreinstellung.documented, but unfavourable: Kein EU-Speicherort, der Ort ist aber eindeutig benannt, sodass die Folgen bewertbar sind.open on a point that decides usability: Der Speicherort ist öffentlich nicht benannt oder vom Kunden nicht steuerbar, sodass sich die Verarbeitung nicht verorten lässt. | documented, tied to a conditionUnited States by default; EU storage only on the Enterprise plan, as a separate environment on a dedicated subdomain of ghe.comEU storage only on the Enterprise plan on ghe.com, centrally managed user accounts, no public repositoriesOpen sourceThe residency variant is not a switch inside an existing account, it is a move. User accounts there are centrally managed, public repositories are unavailable, and some features are missing. Alongside the EU, Australia, the US and Japan can be chosen, and further regions are announced.As of 2026-07-30 |
| Subprocessorsdocumented, no condition attached: Vollständige öffentliche Liste der Unterauftragnehmer mit Zweck und Land; oder es gibt keine, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Liste existiert und ist benannt, aber nur nach Anfrage oder nach Zugang zu einem Vertrauensportal einsehbar, oder sie nennt Zweck und Land nicht vollständig.documented, but unfavourable: Keine geführte Liste; namentlich stehen nur einzelne Dienste in der Datenschutzerklärung, überwiegend solche der eigenen Website.open on a point that decides usability: Weder eine Liste noch eine Nennung der Verarbeiter des Produkts, und kein dokumentierter Weg, sie zu erfahren. | documented, no condition attachedPublic list naming 25 third parties and 7 group companies, each with purpose and country25 named third parties and 7 group companies, 30 days notice, binding to the protection level of the data protection agreementOpen sourceNotable for this collection: the third parties include several model vendors, among them Anthropic and OpenAI, both based in the United States. The page carries no last-changed date, but it does carry a commitment to publish new entries 30 days in advance.As of 2026-07-30 |
| Third-country transferdocumented, no condition attached: Keine Übermittlung in ein Drittland, oder die Übermittlung findet statt und die Grundlage ist benannt und im Vertrag verankert, etwa Standardvertragsklauseln, Angemessenheitsbeschluss oder EU-US-Datenschutzrahmen.documented, tied to a condition: Übermittlung findet statt, eine Grundlage ist genannt, aber ohne Zuordnung, welcher Empfänger auf welcher Grundlage arbeitet.documented, but unfavourable: Übermittlung findet statt und die eigenen Unterlagen widersprechen sich, oder die genannte Grundlage bezieht sich erkennbar nur auf einen Randbereich wie die Marketing-Website.open on a point that decides usability: Übermittlung findet erkennbar statt und eine Grundlage wird nirgends genannt. | open on a point that decides usabilityProcessing overwhelmingly in the United States; we did not find the governing basis for the transfer substantiated on the pages we reviewed25 named third parties and 7 group companies, 30 days notice, binding to the protection level of the data protection agreementOpen sourceThe subprocessor list names the United States as the country for nearly every third party. Whether the vendor relies on the EU-US data privacy framework, on standard contractual clauses, or on both, sits in the contract document and was not readable in this review. It belongs on the table before signing, all the more so next to the competitor, which names both bases openly.As of 2026-07-30 |
| Training on customer datadocumented, no condition attached: Vertraglich oder in der Datenschutzerklärung ausdrücklich ausgeschlossen, mit Erstreckung auf die eingesetzten Modellanbieter; oder es gibt keine Datenübertragung an einen Anbieter.documented, tied to a condition: Ausschluss ab einem bestimmten Tarif, oder die Zusage steht nur auf einer Dokumentationsseite statt im Vertrag, oder die Frage stellt sich für das Werkzeug sachlich kaum und der Anbieter schweigt dazu.documented, but unfavourable: Nutzung ist die Voreinstellung und nur ein Widerspruch beendet sie; oder der Anbieter trainiert eigene Modelle auf bereinigten Kundendaten.open on a point that decides usability: Keine Aussage, obwohl das Werkzeug KI-Funktionen auf Kundeninhalten betreibt. | documented, tied to a conditionRuled out for Copilot Business and Enterprise; the default for the personal Free, Pro and Pro+ plans from 24 April 2026, with an opt-outUse of interaction data from the personal Copilot plans for training from 24 April 2026, with an opt-outOpen sourceThe vendor changed its privacy statement on 25 March 2026. Since then, interaction data from the personal plans is used for training unless you opt out: inputs, outputs, code snippets and the context supplied with them. Private repository content at rest is excluded, the context drawn from working in it is not. For a team that means the plan choice here is a data protection decision, not merely a pricing one. Anyone letting the work happen under personal accounts does not control the opt-out.As of 2026-07-30 |
| Retention and deletiondocumented, no condition attached: Löschfristen nach Vertragsende beziffert und die Löschung oder Rückgabe zugesagt; oder die Fristen bestimmt der Betreiber selbst, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Löschung ist zugesagt, die Fristen sind aber nur teilweise beziffert, oder Sicherungskopien sind ausdrücklich ausgenommen.documented, but unfavourable: Nur der Grundsatz der Erforderlichkeit ohne jede Frist nach Vertragsende, oder Fristen sind allein für Randbereiche wie Website-Protokolle genannt.open on a point that decides usability: Keine Aussage zu Aufbewahrung und Löschung. | documented, tied to a conditionAudit log viewable for 180 days, Git events for 7 days; retention periods for repository content after termination are not publicly quantifieddocs.github.com/…/audit-log-for-an-enterpriseOpen sourceThe 180 days are not a retention commitment but the window in which you can look for yourself. Anyone who has to evidence more must stream the events continuously into a system of their own. What happens to the content after termination is not quantified on the documentation pages reviewed.As of 2026-07-30 |
| Certificationsdocumented, no condition attached: Mehrere anerkannte Nachweise, benannt mit Norm, Fassung und Geltungsbereich, und bezogen auf den Anbieter selbst.documented, tied to a condition: Ein anerkannter Nachweis für den Anbieter belegt, der Bericht aber nur auf Anfrage, oder der Nachweis hängt an einem Tarif, oder der Geltungsbereich bleibt teilweise offen.documented, but unfavourable: Nur pauschale Nennung ohne Norm-Fassung und Geltungsbereich, oder bloße Selbstauskunft, oder die Nachweise gehören dem Infrastrukturanbieter statt dem Anbieter, oder der Prüfzeitraum ist erkennbar veraltet, oder die eigenen Angaben widersprechen sich.open on a point that decides usability: Kein Nachweis genannt und keine Sicherheits- oder Vertrauensseite vorhanden. | documented, but unfavourableThe vendor publicly names ISO, SOC 2 and GDPR, without standard versions and without scope; the reports sit in the Trust Center behind a requestgithub.com/securityOpen sourceThe public security page carries the list without saying which standard, in which version, applies to which service. Anyone who needs to know the scope has to request the reports. That is more weakly documented than at the competitor, which names standard, version and scope in public.As of 2026-07-30 |
| EU AI Act, Article 50documented, no condition attached: Der Anbieter macht eine belegte Aussage, die die eigene Pflicht trägt, etwa Modelldokumentation und Zertifizierung nach ISO/IEC 42001; oder das Werkzeug enthält nachvollziehbar begründet kein KI-System im Sinne der Verordnung.documented, tied to a condition: Der Anbieter äußert sich zur Verordnung oder ordnet die eigene Funktion ein, eine benannte Zusage zu den Transparenzpflichten aus Artikel 50 fehlt aber; oder das Werkzeug enthält kein KI-System, das gegenüber Menschen auftritt, und der Anbieter schweigt.documented, but unfavourable: Das Produkt enthält KI-Funktionen, der Anbieter schweigt dazu oder trägt ein Selbstetikett ohne Nachweis; die Kennzeichnung ist vom Betreiber aber selbst setzbar.open on a point that decides usability: KI spricht im Produkt unmittelbar mit Endkunden und der Anbieter sagt zu Artikel 50 nichts; die Kennzeichnung lässt sich ohne Zusage des Anbieters nicht sicher setzen. | documented, but unfavourableunclearWith Copilot, the system contains an AI system in the sense of the regulation, so the transparency duties under Article 50 apply from August 2026. We found no explicit vendor statement on this on the security, privacy or changelog pages reviewed. The privacy statement change of 25 March 2026 addresses the training question, not the labelling duty.no source given · As of 2026-07-30 |
| Audit loggingdocumented, no condition attached: Nachvollziehbares Protokoll über Zugriffe und Änderungen in allen Tarifen enthalten, mit benannter Frist und Ausleitung in eigene Systeme; oder die Nachvollziehbarkeit liegt vollständig in eigener Hand, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Protokoll vorhanden, aber an einen höheren Tarif oder einen kostenpflichtigen Zusatz gebunden, oder die Ausleitung fehlt in den unteren Stufen; Reichweite und Frist sind benannt.documented, but unfavourable: Protokolle sind nur anbieterseitig beschrieben, oder Reichweite und Frist bleiben offen, sodass sich Nachweispflichten nicht planen lassen.open on a point that decides usability: Öffentlich nicht belegt, ob der Kunde überhaupt ein auswertbares Protokoll erhält. | documented, tied to a conditionAudit log on the Enterprise plan, viewable for 180 days, with streaming to your own systems availableAudit log for 180 days, Git events for 7 days, streaming with a seven-day bufferOpen sourceAnyone needing longer retention streams the events into a system of their own. The buffer for a paused stream holds seven days. Pause it longer and the period before is lost; after three weeks the stream restarts from the present.As of 2026-07-30 |
What it really costs
Entry price
Free with unlimited private repositories, 2,000 build minutes and 500 MB of package storage a month. The Team plan costs 4 US dollars per user per month and includes 3,000 minutes and 2 GB of package storage; Enterprise starts at 21 US dollars with 50,000 minutes and 50 GB. The pricing page currently presents both rates as prices for the first twelve months.Plans, per-user prices, included build minutes and package storageOpen source
As of 2026-07-30
What gets expensive
Not on the seat price but in three places. First, consumption: beyond the included minutes every build run is billed, and larger runners cost a multiple of the standard machine. Second, the add-ons: code security and Copilot are separate per-seat line items that easily double or triple the seat price. Third, regulation: storing data in the EU requires the Enterprise plan, and there you lose public repositories and some features. That is not a surcharge, it is a migration with a project cost of its own.
What it displaces
- Central version server with a locking model
- Passing code around as archives and network shares
- Separate tools for issues, review and delivery
- A self-run build server next to the version server
Interfaces
- REST and GraphQL API
- Webhooks on every repository event
- Build and deployment runs inside the same system
- Sign-in via SAML and account provisioning via SCIM
- Migration tooling for whole organisations
Matching methods
- "Context: Moat or Wall?" TestThe test separates proprietary, compounding assets from bought-in foundation, and with GitHub that line runs visibly between the code, which every clone carries in full, and everything around it, which stays with the vendor.
- Regulatory Density TestThe test separates a general duty from a specific exposure, and evidence of code provenance and approval falls out of GitHub as a by-product, yet it applies to every software vendor alike.
- DORA Delivery DiagnosticThe diagnosis needs a time trail per change, from commit to production, and that trail only exists when review, issue and deployment are attached to the same change.
Alternatives
Sources
- 1.Plans, per-user prices, included build minutes and package storage (opens in a new tab)github.com/pricing · As of 2026-07-30
- 2.25 named third parties and 7 group companies, 30 days notice, binding to the protection level of the data protection agreement (opens in a new tab)docs.github.com/…/github-subprocessors · As of 2026-07-30
- 3.EU storage only on the Enterprise plan on ghe.com, centrally managed user accounts, no public repositories (opens in a new tab)docs.github.com/… · As of 2026-07-30
- 4.General availability of EU data residency on 29 October 2024 (opens in a new tab)github.blog/… · As of 2026-07-30
- 5.Use of interaction data from the personal Copilot plans for training from 24 April 2026, with an opt-out (opens in a new tab)github.blog/… · As of 2026-07-30
- 6.Audit log for 180 days, Git events for 7 days, streaming with a seven-day buffer (opens in a new tab)docs.github.com/…/streaming-the-audit-log-for-your-enterprise · As of 2026-07-30
- 7.Acquisition by Microsoft for 7.5 billion US dollars in stock, announced on 4 June 2018 (opens in a new tab)news.microsoft.com/…/microsoft-to-acquire-github-for-7-5-billion · As of 2026-07-30
- 8.Chief executive stepping down at the end of 2025, with no named successor (opens in a new tab)github.blog/news-insights/company-news/goodbye-github · As of 2026-07-30
- 9.docs.github.com/…/audit-log-for-an-enterprise (opens in a new tab)As of 2026-07-30
- 10.github.com/security (opens in a new tab)As of 2026-07-30
Last reviewed: 2026-07-30 by Dr. Oliver Gausmann, Convios GmbH
Details out of date? Let us know.