GitHub
GitHub, Inc., owned by Microsoft Corporation since 2018 ·github.com· As of: 2026-07-30
Our verdict
Source control creates no edge. No customer buys because the code is versioned cleanly. Without it, though, there is no company, only a set of machines on which somebody once saved something. What matters about this category for the guiding question of this collection is not the function but the ownership: anyone who builds for themselves has to know who owns the place the work sits in, and what it costs to leave it. With GitHub the answer splits in two. The code itself is never captive, because every clone holds the full history. Everything around it is.
Who it fits
Solo
suitable
The free plan carries unlimited private repositories, 2,000 build minutes and 500 MB of package storage a month. For a single person that is not a ceiling but plenty of room.
Mid-market
suitable
Four US dollars per user per month is predictable. The ceiling is not the seat price but consumption: the 3,000 included minutes go quickly once every push triggers a full check pipeline.
Enterprise
suitable with caveats
EU storage exists only as a separate environment on the Enterprise plan under its own subdomain. There, user accounts are centrally managed, public repositories are not available, and some features are missing. Anyone running open projects who also has to store data in the EU cannot have both in one account.
Buy, switch or build
Off-the-shelf
The house vendor's own workshop
Anyone already inside an ecosystem has usually paid for source control already: the Atlassian forge in an Atlassian shop, the in-house development platform in a Microsoft shop. That is pragmatic, and it sits on the same directory service and the same issue tracker. The price is the hiring position. Developers know the market leader's workflows, and a forge nobody outside the building knows costs time at every onboarding. On top of that, these products rarely sit in the front row when investment is allocated.
AI-native
No AI-native replacement, but a shifted load
There is no AI-native forge replacing this category, and none is to be expected, because the job is versioning and rule sets. What changes is the load. Assistants and agents sit on top of the repository and hand in their work as a pull request, so machines produce more changes than humans can review. The bottleneck moves from writing to reviewing. That is not a vendor question but a question of the rules inside the forge: mandatory review, automated check pipelines, and provenance for machine-generated changes.
Build it yourself
Running your own forge
Running your own forge is possible and not exotic. The lean open-source options run on a small server; the heavier open-source alternative brings check pipelines and security scanning with it. The licence costs nothing, the operation does: backup, availability, upgrades, directory integration, being on call. This route works under hard sovereignty requirements and in organisations that run servers anyway. What does not work is falling back to plain Git over SSH with no interface: that loses review, issues and build runs, which is exactly what the forge is for.
Our advice
- Solo: Free plan. Anything else is busywork.
- Mid-market: Buy. Before rolling out Copilot, treat the plan choice as a data protection decision, not a pricing one.
- Enterprise: Buy, but cost out EU residency first, including the features that are missing there.
Who is behind it
Staying power: Established
It is not the vendor that carries this, it is the owner. GitHub has belonged to Microsoft since 2018 and, since its chief executive stepped down at the end of 2025, is no longer run as a separate company with a leader of its own. GitHub publishes no revenue or profit figures for itself. That is a very solid position, and at the same time one in which you read the product's direction off the parent group's strategy rather than off the vendor.
- Ownership: Microsoft, acquired for 7.5 billion US dollars in stock, announced on 4 June 2018 and closed on 26 October 2018 · Source · As of 2026-07-30
- Leadership: Chief executive Thomas Dohmke announced in August 2025 that he would leave at the end of the year; no successor was named, and the leadership team reports into Microsoft's CoreAI organisation · Source · As of 2026-07-30
- Standalone financials: not published; GitHub is absorbed into the parent group's reporting · no source given · As of 2026-07-30
- Maintenance of the subprocessor list: public list naming 25 third parties and 7 group companies; new entries are published at least 30 days before authorisation · Source · As of 2026-07-30
- EU data residency: generally available since 29 October 2024, first for the EU, later for the US, Australia and Japan · Source · As of 2026-07-30
Cost of leaving: Moderate
The code is never captive. Git is distributed, every clone holds the full history, and moving it elsewhere costs one command. What is captive is everything around it: issues, pull requests with their review comments, build runs, packages and the installed apps. There is an API and a migration tool for that, but no format another vendor reads in. The second point weighs more: the server software is not open source. A self-hostable edition exists, but it is a licensed proprietary product from the same maker. Moving from the managed service to running it yourself means, here, staying with the same vendor.
Regulation and data
| Data processing agreement | In place, as a separate document for enterprise customers; subprocessors are expressly bound to itThe subprocessor page states that every third party receiving personal data has signed a written agreement no less protective than the vendor's own data protection agreement. The document is public, but self-serve customers do not sign it separately.Source · As of 2026-07-30 |
|---|---|
| Storage location | United States by default; EU storage only on the Enterprise plan, as a separate environment on a dedicated subdomain of ghe.comThe residency variant is not a switch inside an existing account, it is a move. User accounts there are centrally managed, public repositories are unavailable, and some features are missing. Alongside the EU, Australia, the US and Japan can be chosen, and further regions are announced.Source · As of 2026-07-30 |
| Subprocessors | Public list naming 25 third parties and 7 group companies, each with purpose and countryNotable for this collection: the third parties include several model vendors, among them Anthropic and OpenAI, both based in the United States. The page carries no last-changed date, but it does carry a commitment to publish new entries 30 days in advance.Source · As of 2026-07-30 |
| Third-country transfer | Processing overwhelmingly in the United States; we did not find the governing basis for the transfer substantiated on the pages we reviewedThe subprocessor list names the United States as the country for nearly every third party. Whether the vendor relies on the EU-US data privacy framework, on standard contractual clauses, or on both, sits in the contract document and was not readable in this review. It belongs on the table before signing, all the more so next to the competitor, which names both bases openly.Source · As of 2026-07-30 |
| Training on customer data | Ruled out for Copilot Business and Enterprise; the default for the personal Free, Pro and Pro+ plans from 24 April 2026, with an opt-outThe vendor changed its privacy statement on 25 March 2026. Since then, interaction data from the personal plans is used for training unless you opt out: inputs, outputs, code snippets and the context supplied with them. Private repository content at rest is excluded, the context drawn from working in it is not. For a team that means the plan choice here is a data protection decision, not merely a pricing one. Anyone letting the work happen under personal accounts does not control the opt-out.Source · As of 2026-07-30 |
| Retention and deletion | Audit log viewable for 180 days, Git events for 7 days; retention periods for repository content after termination are not publicly quantifiedThe 180 days are not a retention commitment but the window in which you can look for yourself. Anyone who has to evidence more must stream the events continuously into a system of their own. What happens to the content after termination is not quantified on the documentation pages reviewed.Source · As of 2026-07-30 |
| Certifications | The vendor publicly names ISO, SOC 2 and GDPR, without standard versions and without scope; the reports sit in the Trust Center behind a requestThe public security page carries the list without saying which standard, in which version, applies to which service. Anyone who needs to know the scope has to request the reports. That is more weakly documented than at the competitor, which names standard, version and scope in public.Source · As of 2026-07-30 |
| EU AI Act, Article 50 | unclearWith Copilot, the system contains an AI system in the sense of the regulation, so the transparency duties under Article 50 apply from August 2026. We found no explicit vendor statement on this on the security, privacy or changelog pages reviewed. The privacy statement change of 25 March 2026 addresses the training question, not the labelling duty.no source given · As of 2026-07-30 |
| Audit logging | Audit log on the Enterprise plan, viewable for 180 days, with streaming to your own systems availableAnyone needing longer retention streams the events into a system of their own. The buffer for a paused stream holds seven days. Pause it longer and the period before is lost; after three weeks the stream restarts from the present.Source · As of 2026-07-30 |
What it really costs
Entry price
Free with unlimited private repositories, 2,000 build minutes and 500 MB of package storage a month. The Team plan costs 4 US dollars per user per month and includes 3,000 minutes and 2 GB of package storage; Enterprise starts at 21 US dollars with 50,000 minutes and 50 GB. The pricing page currently presents both rates as prices for the first twelve months.
Source · As of2026-07-30
What gets expensive
Not on the seat price but in three places. First, consumption: beyond the included minutes every build run is billed, and larger runners cost a multiple of the standard machine. Second, the add-ons: code security and Copilot are separate per-seat line items that easily double or triple the seat price. Third, regulation: storing data in the EU requires the Enterprise plan, and there you lose public repositories and some features. That is not a surcharge, it is a migration with a project cost of its own.
What it displaces
- Central version server with a locking model
- Passing code around as archives and network shares
- Separate tools for issues, review and delivery
- A self-run build server next to the version server
Interfaces
- REST and GraphQL API
- Webhooks on every repository event
- Build and deployment runs inside the same system
- Sign-in via SAML and account provisioning via SCIM
- Migration tooling for whole organisations
At Convios: Trialled by us
The source of our own sites sits on GitHub, on the free plan and in a small number of private repositories. We deliberately do not report that as being in use, because it is where the code is kept rather than a decision for the platform. What this profile examines at Enterprise level, meaning EU storage, the audit log, central account management and the Copilot plans, we do not know from our own operation. There the assessment rests on publicly available vendor pages and documentation.
Alternatives
Evidence
- 1.Plans, per-user prices, included build minutes and package storage · As of 2026-07-30
- 2.25 named third parties and 7 group companies, 30 days notice, binding to the protection level of the data protection agreement · As of 2026-07-30
- 3.EU storage only on the Enterprise plan on ghe.com, centrally managed user accounts, no public repositories · As of 2026-07-30
- 4.General availability of EU data residency on 29 October 2024 · As of 2026-07-30
- 5.Use of interaction data from the personal Copilot plans for training from 24 April 2026, with an opt-out · As of 2026-07-30
- 6.Audit log for 180 days, Git events for 7 days, streaming with a seven-day buffer · As of 2026-07-30
- 7.Acquisition by Microsoft for 7.5 billion US dollars in stock, announced on 4 June 2018 · As of 2026-07-30
- 8.Chief executive stepping down at the end of 2025, with no named successor · As of 2026-07-30
Last reviewed: 2026-07-30byDr. Oliver Gausmann, Convios GmbH
Details out of date? Let us know.