Why This Matters

Understanding where your data goes (and doesn't) is essential for compliance, security, and trust. This lesson traces a request from keystroke to rendered suggestion.

Concept Explained

A Copilot request flows: editor → Copilot extension → Copilot service (proxy) → model provider → response back. Each touchpoint has privacy implications.

How It Works

Keystroke triggers context assembly. Extension sends to Copilot service (proxy.githubusercontent.com). Service routes to model provider (OpenAI/Anthropic/Google). Response streams back. Each hop is logged differently.

Step-by-Step Tutorial

1. Trace the request

2. Identify touchpoints

3. Reason about privacy

4. Plan DLP

5. Document

Real-World Example

A fintech traced Copilot's data flow for compliance. Found: prompts transmitted to Copilot service (encrypted in transit). Business plan: not used for training. No persistence beyond processing. Compliance approved with one mitigation: pre-commit secret scanner to catch before transmission.

Example Prompts / Commands / Code

sequenceDiagram
    participant Dev as Developer
    participant Ext as Copilot Extension
    participant GH as GitHub Service
    participant Model as Model Provider

    Dev->>Ext: Keystroke
    Ext->>Ext: Context assembly
    Ext->>GH: Encrypted prompt
    GH->>Model: Routed request
    Model->>GH: Streaming response
    GH->>Ext: Streamed tokens
    Ext->>Dev: Rendered suggestion

    Note over GH: Business/Enterprise: not used for training
    Note over GH: Free/Pro: opt-out required

Plan          Training   Retention   Encryption
-----------------------------------------------------
Free          Opt-in     Short       TLS in transit
Pro           Opt-in     Short       TLS in transit
Business      No         Short       TLS + at rest
Enterprise    No         Short       TLS + audit log

Common Mistakes

• Assuming Copilot is local — it's a cloud service.
• Not tracing where data goes — compliance gaps.
• Treating all plans the same — privacy differs.
• No DLP integration — secrets can leak.

Best Practices

• Trace the request end-to-end.
• Document each touchpoint's privacy posture.
• Use Business/Enterprise for compliance-sensitive work.
• Integrate DLP at editor or extension level.
• Share data flow diagram with security/compliance.

Troubleshooting

Practical Exercise

Professional Challenge

Frequently Asked Questions

Further Reading

• Copilot trust center

Official References

• Copilot trust center

Related lessons: BE-32, PR-01