served on GitHub's legal agent

In this article

Guidelines for Legal Requests of User Data

Copy markdown

In this article

Are you a law enforcement officer conducting an investigation that may involve user content hosted on GitHub? Or maybe you're a privacy-conscious person who would like to know what information we share with law enforcement and under what circumstances. Either way, you're on the right page.

In these guidelines, we provide a little background about what GitHub is, the types of data we have, and the conditions under which we will disclose private user information. Before we get into the details, however, here are a few important details you may want to know:

• We will notify affected users about any requests for their account information, unless prohibited from doing so by law or court order.

• We will not disclose location-tracking data, such as IP address logs, without a valid court order or search warrant.

• We will not disclose any private user content, including the contents of private repositories, without a valid search warrant.

About these guidelines

Our users trust us with their software projects and code—often some of their most valuable business or personal assets. Maintaining that trust is essential to us, which means keeping user data safe, secure, and private.

While the overwhelming majority of our users use GitHub's services to create new businesses, build new technologies, and for the general betterment of humankind, we recognize that with millions of users spread all over the world, there are bound to be a few bad apples in the bunch. In those cases, we want to help law enforcement serve their legitimate interest in protecting the public.

By providing guidelines for law enforcement personnel, we hope to strike a balance between the often competing interests of user privacy and justice. We hope these guidelines will help to set expectations on both sides, as well as to add transparency to GitHub's internal processes. Our users should know that we value their private information and that we do what we can to protect it. At a minimum, this means only releasing data to third-parties when the appropriate legal requirements have been satisfied. By the same token, we also hope to educate law enforcement professionals about GitHub's systems so that they can more efficiently tailor their data requests and target just that information needed to conduct their investigation.

GitHub terminology

Before asking us to disclose data, it may be useful to understand how our system is implemented. GitHub hosts millions of data repositories using the Git version control system. Repositories on GitHub—which may be public or private—are most commonly used for software development projects, but are also often used to work on content of all kinds.

Users: Users are represented in our system as personal GitHub accounts. Each user has a personal profile, and can own multiple repositories. Users can create or be invited to join organizations or to collaborate on another user's repository.

Collaborators: A collaborator is a user with read and write access to a repository who has been invited to contribute by the repository owner.

Organizations: Organizations are a group of two or more users that typically mirror real-world organizations, such as businesses or projects. They are administered by users and can contain both repositories and teams of users.

Repositories: A repository is one of the most basic GitHub elements.