What Copilot Actually Sends to Microsoft

GitHub Copilot sends context to Microsoft Azure OpenAI Service to generate completions. That context includes the current file, surrounding files in your workspace, and recent edit history. Microsoft's terms of business allow them to use this data to improve their models; an enterprise agreement with telemetry disabled changes that.

For most developers building standard web applications, this is an acceptable trade. For teams building in regulated industries, working on novel algorithms, or bound by client NDAs, the risk profile is different.

The Three Risk Categories

Category 1: Regulated Data in Code

If your codebase contains references to patient identifiers, account numbers, or PII data structures, even in schema definitions or variable names, sending that code to Copilot creates HIPAA, PCI-DSS, or GDPR exposure.

The core risk is that identifiers referencing regulated data patterns leave your network perimeter with zero documented controls, more than any leak of your specific patient list.

Category 2: Proprietary Algorithms

Quantitative trading strategies, fraud detection models, recommendation engines, and similar proprietary algorithms have real competitive value. If those algorithms live in your codebase and Copilot has access to your workspace, the logic is in transit to third-party infrastructure.

Category 3: Client Confidentiality

Enterprise contractors and consulting firms often have explicit confidentiality clauses covering client code. Using Copilot on that code calls for client consent; skipping that step may breach contract terms. Several large consulting firms discovered this in 2025 when clients began auditing AI tool usage.

Option 1: Disable Copilot for Sensitive Files

The simplest approach is selective exclusion. Copilot supports a .copilotignore file that works like .gitignore:

# .copilotignore
src/algorithms/
src/models/risk-engine/
config/credentials/
*.env

This tells Copilot to skip indexing those directories. The limitation: developers still have Copilot available and can manually paste sensitive code into prompts. Enforcing exclusion takes more than tooling configuration alone.

When to use this approach

Teams where developer judgment is the right enforcement mechanism. It works well for small teams with strong security culture and low regulatory exposure.

Option 2: Enterprise Agreement with Telemetry Disabled

GitHub Copilot for Business and Copilot Enterprise include options to disable telemetry and data retention. With these settings:

• -Prompts are discarded after completion generation
• -Code stays out of model training
• -Audit logs are available for enterprise review

This reduces risk while transit exposure remains. The code still leaves your network and is processed on Microsoft infrastructure, even when it is discarded afterward.

When to use this approach

Organizations with Microsoft enterprise agreements already in place, where the primary concern is data retention more than transit.

Option 3: Proxy-Level Protection with Pretense

Pretense operates as a local proxy between your IDE and any AI API, including the OpenAI-compatible API that Copilot extensions use. It intercepts every request, swaps proprietary identifiers and detected secrets for stand-ins before transit, and swaps the identifiers back in the response.

Setup for Copilot-compatible extensions:

# Install Pretense
curl -fsSL https://pretense.ai/install.sh | sh

# Initialize in your project
pretense init

# Start the proxy
pretense start --port 9339

# Configure your Copilot-compatible extension to use the local proxy
# In VS Code settings:
# "github.copilot.advanced": { "serverUrl": "http://localhost:9339" }

With this configuration, the code that leaves your network contains only synthetic identifiers. Your proprietary function names, variable names, and class names stay on your machine, and Microsoft servers see only stand-ins.

What the developer experiences

The workflow stays the same. Copilot completions still appear inline. The suggestions reference synthetic names in the response, and Pretense swaps them back byte-exact before the IDE receives the completion. The developer sees completions with their real identifier names. Secrets stay as stand-ins by design.

When to use this approach

Teams with proprietary algorithms, regulated data in codebases, or explicit client confidentiality requirements. Also appropriate for any team that wants an audit trail of what code was sent to AI APIs.

Enforcement at the CI/CD Layer

Developer-side protection works as long as developers keep it on. Enterprise enforcement requires pushing protection to the pipeline.

Pretense includes a GitHub Action that scans pull requests for unprotected AI API calls:

# .github/workflows/ai-security.yml
- uses: pretense/scan-action@v1
  with:
    fail-on: critical
    report: pr-comment

This blocks merges when proprietary identifiers are detected in outbound API calls, regardless of which AI tool generated them.

Practical Recommendation

The right approach depends on your regulatory environment and risk tolerance:

• -Low regulatory exposure, small team: .copilotignore plus developer education
• -Enterprise with Microsoft contracts: Copilot for Business with telemetry disabled
• -Regulated industry or proprietary algorithms: Pretense proxy plus CI enforcement

The last category is the one approach that gives you both protection and an audit trail. If your SOC2 auditor or your client asks to see evidence of AI tool controls, a proxy log is a demonstrable artifact. An employee training record is a far weaker one.

How I run Pretense on my own code

I build Pretense with Claude Code, and my sessions run through it. Here is the setup I give a new engineer, in order.

1. -Run the agent through the proxy. Type pretense run claude where you would type claude. It starts a local proxy on port 9339, points Claude Code at it and stops the proxy when the session ends. Detected secrets and PII leave the laptop as stand-in tokens.
2. -Put hooks on every repo. pretense install adds a pre-commit and a pre-push hook. A key that never lands in git is a key an agent never reads.
3. -Scan before an agent reads the repo. pretense scan path . lists what it finds. In CI, pretense scan ci exits 0 when clean, 2 on findings and 3 when it examined nothing. Treat 3 as a failure.
4. -Preview the swap. pretense review . shows what would be mutated. pretense mutate <file> --preview prints one file mutated and leaves the file on disk as it was.
5. -Round-trip a file you need to share. pretense mutate <file> --map <map> swaps the secrets in place. pretense reverse <file> --map <map> turns it back into the original, byte for byte, from the encrypted map on your machine. We run that round trip on real files before every CLI release and compare sha256 hashes.

One thing I learned the hard way: inside a session the agent sees stand-ins, so a file the agent writes can hold a stand-in where you expected a real value. Grep what the agent wrote before you ship it.

What Pretense will not do is put a secret back into the model's answer. Code identifiers come back byte-exact. Secrets and PII stay as stand-ins in the response. That is deliberate: a prompt-injected model can echo a token into a link, and reversing it there would hand over the real key.

What this means if you buy security

The outcome: your engineers keep their AI coding tools, and detected secrets and PII leave each laptop as stand-in tokens.

• -The control sits on the endpoint. The swap runs on the developer's machine before the request leaves. No shared gateway holds every team's keys.
• -You get evidence, not a memo. pretense audit --format csv exports every mutation event. Add --framework SOC2 to keep only the events that map to that framework.
• -Check it on your own code. Detection is pattern and entropy based, and coverage varies by data type. Run pretense review . on a real repo and read what it catches before you sign off.
• -Start with one team. One repo, pretense run claude, one week. Then read the audit log with the team lead.

Try it on your own repo: create a free account, then run npm i -g @pretense/cli and pretense run claude. If you need a security review first, talk to me.