GitHub compliance, certifications and attestations

Dev tools · 7 certifications held · 3 from public registries · read Sep 24, 2026

Certification	Status	Source	Evidence
SOC reports
SOC 1 Type II Vendor page	Type II	Vendor page	Sep 24, 2026
SOC 2 Type II Vendor page	Type II	Vendor page	Sep 24, 2026
ISO standards
ISO/IEC 27001 Held Vendor page	Held	Vendor page	Sep 24, 2026
US government
FedRAMP Low GitHub Enterprise Cloud FedRAMP Marketplace	Low	FedRAMP Marketplace	Sep 23, 2026
Finance
PCI DSS Held Vendor page	Held	Vendor page	Sep 24, 2026
Privacy and cloud
Data Privacy Framework Held EU-US, UK extension, Swiss-US; non-HR data. GitHub Data Privacy Framework List	Held	Data Privacy Framework List	Sep 23, 2026
CSA STAR Level 2 CAIQ, certification CSA STAR Registry	Level 2	CSA STAR Registry	Sep 23, 2026

From public trust centers and registries on the date shown. Confirm scope with the vendor. Logos via logo.dev; trademarks belong to their owners.

History

Date	Change	Source
Oct 4, 2018	Added FedRAMP Low GitHub Enterprise Cloud	FedRAMP Marketplace
May 30, 2018	Added CSA STAR First listed in the CSA STAR Registry	CSA STAR Registry
Apr 2, 2018	In process FedRAMP Low GitHub Enterprise Cloud	FedRAMP Marketplace
Jan 26, 2017	Added Data Privacy Framework GitHub	Data Privacy Framework List

About GitHub

Code hosting, Actions and Copilot.

No public evidence found for

SOC reports: SOC 3
ISO standards: ISO 27017, ISO 27018, ISO 27701, ISO 9001, ISO 22301, ISO 20000, ISO 27799
AI governance: ISO 42001, STAR AI
US government: DoD IL, GovRAMP, TX-RAMP, CMMC, 800-171, 800-53, FIPS 140, ITAR, CJIS, IRS 1075, 508/VPAT
Finance: PCI 3DS, SWIFT, 17a-4, GLBA, SOX, FFIEC, MAS TRM, APRA, OSFI, FISC, DORA
Health: HIPAA, HITRUST, HDS, NHS DSPT, PHIPA
Life sciences (GxP): GxP, Part 11, Annex 11, CSV
Privacy and cloud: CBPR, EU CoC
Regional programs: Cyber Ess., G-Cloud, C5, ENS, SecNum, IRAP, ISMAP, MTCS, K-ISMS, TISAX
Education: FERPA, HECVAT, COPPA