Compliance: GitHub server locations (USA?) and data encryption

[rdalisay]

Select Topic Area

Question

Body

Before we can sign up for GitHub accounts, my company is requiring official documentation from GitHub to ensure that:

1. All of our data (including source code) will be stored only on servers located in the United States.
2. All data will be encrypted in transit and at rest.

I've been unable to find any documentation from GitHub about this. GitHub Sales pointed me to GitHub Support. However, the "GitHub Support" URL they shared is only to the self-serve knowledge base. It seems that to get a human to answer my questions, I will have to sign up for a paid plan first.

Could someone please point me to GitHub official docs providing the above info? Or, if you're from GitHub, answer them in an official capacity? Thank you.

[queenofcorgis]

Hi there,

Thank you for your patience. I was reviewing our backlog of unanswered posts and I can share the following, all linked from our various documentation:

1. From our documentation:

By default, GitHub stores data for GitHub.com in the USA.

2. From the GitHub Enterprise Trust Center:

All data including Git data, issues, comments, projects, attachments, pages, etc. is encrypted at rest with AES-256 encryption with keys managed by the Azure platform. ¹

GitHub encrypts data in transit using TLSv1.2 or higher, and private data is transmitted exclusively via SSH or HTTPS (with SSLv* disabled). ²

[BagasAjiSaputra]

insightful

[BagasAjiSaputra]

Insightfuls