GitHub
Transparency
Breakdown
| Subprocessor list | 30 / 30 | |
| Processing locations | 8 / 8 | |
| Purposes | 7 / 7 | |
| Data processing addendum | 12 / 12 | |
| Trust center | 8 / 8 | |
| Privacy policy | 6 / 6 | |
| security.txt | 6 / 6 | |
| Security page | 5 / 5 | |
| Status page | 5 / 5 | |
| Vulnerability disclosure | 5 / 5 | |
| Pages still reachable | 8 / 8 | |
| Total | 100 / 100 |
Only documents we can retrieve count: a page behind a login or a broken link scores nothing.
Badge
For GitHub's own site; it updates with the rating.
<a href="https://thirdpartyindex.com/vendors/github"><img src="https://thirdpartyindex.com/badge/github.svg" alt="GitHub transparency rating on Third Party Index" height="20"></a>[](https://thirdpartyindex.com/vendors/github)Documents
| Document | Verified | Changed | Evidence |
|---|---|---|---|
| Trust center | snapshot | ||
| Subprocessor list | snapshot | ||
| Data processing addendum | snapshot | ||
| Privacy policy | snapshot | ||
| Terms | snapshot | ||
| Security page | snapshot | ||
| security.txt | snapshot | ||
| Status page statuspage | snapshot | ||
| Security advisories | snapshot |
Subprocessors
25 third parties, 5 affiliates. CSV · Atom
| Name | Purpose | Location | Listed since |
|---|---|---|---|
| Amazon Web Services Inc (AWS) | Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services | Corporate: United States; Location of Processing: United States | |
| Anthropic PBC | AI Inference and AI Services | Corporate: United States; Location of Processing: United States | |
| Cerebras Systems Inc. | AI Inference and AI Services | Corporate: United States; Location of Processing: United States | |
| Cloudflare | Content delivery service | Corporate: United States; Location of Processing: United States | |
| DataDome Solutions, Inc. | Security management | Corporate: United States; Location of Processing: United States, France | |
| Elasticsearch, Inc. | Cloud Hosted Infrastructure | Corporate: United States; Location of Processing: United States | |
| Fastly | Content delivery service | Corporate: United States; Location of Processing: United States | |
| Fireworks AI | AI Inference and AI Services | Corporate: United States; Location of Processing: United States, Germany, Iceland | |
| FullStory, Inc. | Customer support ticketing analysis | Corporate: United States; Location of Processing: United States | |
| Google Cloud Platform (GCP) | Cloud Hosted Infrastructure, AI Inference and AI Services | Corporate: United States; Location of Processing: United States, Belgium, Singapore | |
| Hewlett-Packard Limited | Cloud Hosted Infrastructure | Corporate: United States; Location of Processing: United States | |
| LambdaTest | Cloud Hosted Infrastructure | Corporate: United States; Location of Processing: United States | |
| Microsoft (Azure) | Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services; Cognitive Services and customer support ticketing analysis; Technical Services | Corporate: United States; Location of Processing: United States; Location of Processing: United States, Australia, Brazil, Canada, France, Japan, Norway, Spain, Sweden, Switzerland, United Kingdom; Location of Processing: United States, Canada, Chile, Mexico | |
| Moveworks | Customer support ticketing analysis | Corporate: United States; Location of Processing: United States | |
| NexMo Inc (aka Vonage) | SMS notification provider for 2 Factor Authentication | Corporate: United States; Location of Processing: United States | |
| npm Inc | GitHub Subsidiary | Corporate: United States; Location of Processing: United States | |
| Obsidian Security | Security management | Corporate: United States; Location of Processing: United States | |
| OpenAI | AI Inference and AI Services | Corporate: United States; Location of Processing: United States | |
| Oracle America, Inc. | Cloud Hosted Infrastructure | Corporate: United States; Location of Processing: United States | |
| Pusher | Building and managing real-time infrastructure for web and mobile applications | Corporate: United States; Location of Processing: United States | |
| Semmle Inc | GitHub Subsidiary | Corporate: United States; Location of Processing: United States | |
| Tines Automation Inc. | Security management | Corporate: United States; Location of Processing: United States | |
| Twilio (SendGrid) | SMS notification provider for 2 Factor Authentication | Corporate: United States; Location of Processing: United States | |
| xAI | AI Inference and AI Services | Corporate: United States; Location of Processing: United States | |
| Zendesk | Customer support ticketing system | Corporate: United States; Location of Processing: United States |
GitHub affiliates (5)
Listed as a subprocessor by (67)
Purposes as each company states them.
Airbyte airbyte.com Customer Support; Customer support issue tracking, source code hosting, and CI/CD workflow automation.
Akuity akuity.io
Anaconda anaconda.com Source code storage and version control
Artie artie.com
AssemblyAI assemblyai.com Code forge where code is developed, reviewed and maintained.; Consolidating production code resources so they are accessible to authorized staff.
AuthZed authzed.com Code hosting, community support, and communication services
Belvo belvo.com Source Code Management and Security Tooling; Source Code Repositories, Static Application Security Testing (SAST), Software Composition Analysis (SCA)
Black Forest Labs bfl.ai
Blooket blooket.com Code version control and deployments
CITCON citcon.com Source code repository
CamelAI camelai.com GitHub is our Git service provider. It is used to store application code across environments and manage deployments.
Campfire campfire.ai Source code hosting and CI/CD. Stores Campfire's application code; no customer data is processed.
ClickHouse clickhouse.com Support escalations
CodeRabbit coderabbit.ai Version control
Collibra collibra.com Environment operational management
Conveo conveo.ai **Processing Activity Description** Hosting of Conveo's codebase and deployment of code (source control, CI/CD pipelines, and code review workflows). **Data Residency / Processing Location** United States **Headquarters Location** San Francisco, United States (subsidiary of Microsoft Corporation); Version control
Depot depot.dev Code Repository
Double doublehq.com Application hosting; Cloud service that stores the application codebase.
Dromo dromo.io
Expensify expensify.com Member Data and Personal Data; Version Control
Factory factory.ai
Fastmail fastmail.com Hosting of code as an open source tool
GitGuardian gitguardian.com Source code management for ggshield
Guesty guesty.com
Hugging Face huggingface.co Hosting code
Hyperbolic hyperbolic.ai
Inngest inngest.com
Kedify kedify.io Source Control
Kickbox kickbox.com Code Repository; Version control
KrakenD krakend.io
Langfuse langfuse.com Support escalations
Mapbox mapbox.com Code development, testing, and ticketing system
Microsoft microsoft.com AI model provider
MinIO min.io Source code repository; processes contributor names, email addresses, and source code
Motion usemotion.com Code hosting
NimbleRx nimblerx.com
OpenRouter openrouter.ai Version Control
Orb withorb.com Code version control and CI/CD
Ory ory.com Source Code and Issue Management Solution (OpenSource and Ory Cloud), discussion forum.; Version control
Participatory Culture Foundation pculture.org
Pilosa pilosa.com Developer tooling
PlanetScale planetscale.com Code hosting
Posit posit.co
Quarterzip quarterzip.ai
Qventus qventus.com
Redis redis.io Search and analytics tool for support functions (such as log retention)
Replicated replicated.com Customer support
Retell AI retellai.com
Rewardful rewardful.com Platform for developers to collaborate on software projects, providing tools for version control, code hosting, and project management.; Version control
Serverless Framework serverless.com Hosts source code repositories and supports version control, collaboration, and CI/CD workflows.; Version control
SigNoz signoz.io
Snitcher snitcher.com
Supabase supabase.com Authorized Users account authentication
Svix svix.com Svix uses this issue-tracking software to manage support requests from customers.
Teleport goteleport.com Code Repository, Issue Tracking and Management
Terramate terramate.io
Testlio testlio.com
Toggl toggl.com Issue management
Traversal traversal.com Code hosting & DevOps
Upstash upstash.com
Userflow userflow.com
Userlist userlist.com Project management
Vast AI vast.ai
Vespa.ai vespa.ai
Zuplo zuplo.com
marimo marimo.io OAuth sign-in and importing notebooks from public repositories
rollbar docs.rollbar.com Source Code Repository
Federal contracts
By funding agency. UEI WR2ZN519GFX4 · checked Sep 27, 2026 · snapshot
| Agency | Prime awards | Obligated | Subawards | Subaward total | Years |
|---|---|---|---|---|---|
| Executive Office of the President | 1 | $158.7K | — | — | 2023–2026 |
| Consumer Financial Protection Bureau | 4 | $150.2K | — | — | 2011–2016 |
| Department of the Air Force Department of Defense | — | — | 3 | $118.4K | 2024–2026 |
| Department of the Army Department of Defense | 4 | $100.2K | — | — | 2012–2022 |
| Department of State | 2 | $58.0K | — | — | 2014–2015 |
| Federal Aviation Administration Department of Transportation | — | — | 1 | $47.9K | 2023 |
| Immediate Office of the Secretary of Defense Department of Defense | 1 | $40.6K | — | — | 2017–2018 |
| Department of the Navy Department of Defense | 8 | $40.0K | — | — | 2012–2016 |
| Federal Communications Commission | 14 | $30.0K | — | — | 2013–2026 |
| National Institutes of Health Department of Health and Human Services | 5 | $28.4K | — | — | 2013–2016 |
| National Telecommunications and Information Administration Department of Commerce | 2 | $27.7K | — | — | 2016–2021 |
| National Institute of Standards and Technology Department of Commerce | 3 | $24.3K | — | — | 2016–2020 |
| Department of Energy | 1 | $7.5K | — | — | 2017 |
| Office of the Chief Information Officer General Services Administration | 1 | $5.4K | — | — | 2017 |
| National Aeronautics and Space Administration | 1 | $5.0K | — | — | 2013 |
1 more agencies · All 52 records
Prime awards and subawards reported by prime contractors. Purchases through a reseller name the reseller, not the vendor.
Changes
None since tracking began.