GitHub Repositories: Export Rights, Licenses and Selling Code Data

A company can license its GitHub repositories for AI training because GitHub's Terms of Service leave ownership with the customer, but the repositories must first leave GitHub, and an organization migration archive is deleted seven days after it is generated. GitHub also takes its own license to train its AI features under section D.4 (Terms effective April 27, 2026), which is separate from any license the company grants.

GitHub repositories are one source in AI training data licensing, and six programs name GitHub in their data lists or process (checked November 9, 2026). Licensing none of it is a valid result.

The DataPacts Editorial Team dates every term and program statement below; the method is in how we source, date and check every figure.

What Licensing GitHub Data for AI Training Involves

Licensing GitHub data means granting an AI developer, or a vendor or intermediary that supplies one, the right to train on a copy of the company's private repositories, usually with their commit history, while the company keeps ownership.

GitHub, Inc., a subsidiary of Microsoft Corporation, hosts the code and is not a party to that license. Brendan Foody, who describes himself as Mercor's CEO, states in a LinkedIn post that GitHub appears among 53 % of Mercor's more than 300 partner enterprises across 90 systems (checked November 9, 2026), and SimpleClosure states that 82 % of its AssetHub workspaces include GitHub (article of September 3, 2026). Both are claims. Pangea.ai prices git history as its own unit, at USD 100 per million source tokens and USD 40 per million git-history tokens by its own claim (checked November 9, 2026).

Code as a data type, with acquirers, rates and eligibility, is covered in selling or licensing source code and codebases; this page stays on GitHub's terms, routes and programs.

What GitHub's Terms Say About Licensing Repository Content

Three parts of GitHub's terms bear on a license: the ownership clause, the license GitHub takes for itself, and the Acceptable Use limits on data taken from GitHub.

The table compares what GitHub's own documents state on each point (as of 2026-11-09).

Ownership of Repository Content Under Section D.3

Section D.3 of GitHub's Terms of Service states "You own Your Content", so hosting code on GitHub does not transfer it to GitHub (Terms effective April 27, 2026).

Ownership on the host is one layer only, because contributors and bundled components carry their own rights; the rights audit for data you want to license covers the other layers.

The License GitHub Takes Under Section D.4

Section D.4 gives GitHub a license to customer content that covers training the AI models of GitHub and its Affiliates, and the Terms state that this license is not a sale or restricted transfer. A license the company grants to a data buyer is a separate grant.

Acceptable Use Limits on Data Taken From GitHub

GitHub's Acceptable Use Policies bar using information taken from GitHub through scraping or the API for spamming or for selling personal information, for example to recruiters, headhunters and job boards.

The bar concerns data about other people taken from GitHub. Repositories the company did not write, including forks and copies of public projects, are rejected by acquirers: Pangea.ai accepts only owned private code, and pre.dev requires a repository that is not public and not a fork (both checked November 9, 2026). The conditions of outside code are the subject of open-source license contamination when licensing a codebase, covered in open-source license contamination when licensing a codebase.

How Repositories Leave GitHub: Archives, Connections and Clocks

Repositories reach an AI buyer either as an exported copy or through a read-only connection that a data program sets up, and both routes run on GitHub's clocks.

Organization Migration Archives and Deletion

GitHub's migrations API produces an organization migration archive, and GitHub deletes that archive automatically seven days after it is created.

The archive is therefore generated when a buyer or intermediary is ready to receive it. Deleting an organization permanently removes all repositories, wikis, issues and pull requests (checked November 9, 2026), so a deletion before any copy exists leaves nothing to license.

Read-Only Connections by Data Programs

Several programs ask for a connection to the company's GitHub account instead of an exported file: Pangea.ai asks owners to connect GitHub, GitLab or Bitbucket read-only, SimpleClosure lets a company connect a GitHub repository, and Mercor lists a Connect step (all checked November 9, 2026). The wider comparison sits in buyer connectors vs native exports.

Troveo states "No OAuth access or install required", Turing takes samples through a private folder, and Avelence states no default system access. The type of GitHub app and the permission scopes behind a connection are not stated by these programs, so the seller asks in writing what access is granted and when it is revoked.

GitHub's Own AI Training vs a Company Licensing Its Code

GitHub training its own AI on code it hosts is a separate question from a company's decision to license its repositories to an AI developer.

The first rests on section D.4. GitHub states that it uses Copilot Free, Pro and Pro+ interaction data for AI training from April 24, 2026, announced March 25, 2026, with an opt-out in settings; this is GitHub's statement, and nothing here says GitHub trains on private repository contents.

The second is the company's own grant and runs on its own contract. The settings are covered in opting out of AI training.

Data Programs That Name GitHub

Six programs on record name GitHub in their data lists or in their process, each listed here with its role and the date its page was checked.

The table lists them alphabetically with the route or term relevant to GitHub data (as of 2026-11-09); it carries no payout column by design.

Intermediaries place, broker or resell data on the holder's behalf and do not acquire it.

Terms differ on what matters for code. Pangea.ai states that its license is non-exclusive, the owner keeps ownership, withdrawal is possible before presentation and then needs 30 days' notice, and the ownership warranty is uncapped. Turing states a non-exclusive license with a 90-day period in which only Turing sells the record, SimpleClosure a license or an outright sale, and Troveo that the seller keeps ownership (all checked November 9, 2026). Payouts sit with AI data partnership payouts and program terms compared, each dated.

What Commit History Carries: Authors, Secrets and Outside Code

Commit history records who changed what and when, so it can carry staff names, credentials and code the company did not write.

GitGuardian states that 32.2 % of internal repositories hold at least one hardcoded secret, against 5.6 % of public repositories (State of Secrets Sprawl 2026 report page, seen November 9, 2026). pre.dev states that its exposure check covers all branches and tags, removes secrets and personal data, and pseudonymises authors (checked November 9, 2026).

Whether the company owns the code its employees, contractors and founders wrote is a separate question; the assignments are covered under who owns the code you want to sell.

Benefits, Risks, Downsides and Alternatives of Licensing GitHub Repositories

Licensing GitHub repositories can earn income from code that already exists without giving up ownership, and it also releases history that cannot be recalled once a model has trained on it.

Benefits

• Ownership stays with the company in the terms Pangea.ai, Troveo and Turing state.
• Some programs carry preparation costs: Mercor states that it covers extraction, anonymization and transfer costs.

Risks

• Secrets in history, at the rates GitGuardian states.
• Labelbox Prism states that "Models already trained on the data cannot be unlearned".
• Personal data of contributors in author fields and commit messages.

Downsides

• The seven-day archive and the organization deletion force a planned export.
• Exclusivity windows, such as Turing's 90 days, limit other buyers.

Alternatives

• Do not license at all.
• License some repositories only.
• License source without history, since Pangea.ai prices history separately.
• Keep the code for internal use.

Where GitHub Fits Among Source Systems and the Seller Process

GitHub is one source system among several a company may license, and its export comes after the readiness check and inventory and before de-identification and the choice of buyer. The parent page compares export rights and mechanics by source system, and issue history that travels with code follows Jira data export rights, while chat follows Slack data export rights by plan. The other code hosts are covered in GitLab export and Bitbucket export. The wider case of software companies licensing code and product data and the full sequence to sell or license company data to AI companies sit alongside.

The steps that touch a GitHub export run in this order:

1. Check data sale readiness.
2. Build the data inventory for an AI data sale.
3. Review company data that cannot be licensed.
4. Apply PII removal and de-identification.
5. Write the data manifest.
6. Work through choosing a buyer for your data.
7. Negotiate the AI data licensing agreement.

Repositories of a Closed or Insolvent Company

A closed company can license its repositories only if someone with authority still controls the GitHub organization before it is deleted. SimpleClosure states that it serves shutting-down startups and takes a percentage only if assets sell or license, and Turing states that it accepts companies shut down within or beyond 90 days (checked November 9, 2026). The route is described in selling data from a shut-down or defunct company, and the deletion deadlines before a shutdown in exporting company data before shutting down.

Copilot Litigation and Licensed Repositories

The Copilot class action concerns code that AI tools reproduce, not the licensing of private repositories: on September 16, 2026 the Ninth Circuit (No. 24-7700) affirmed the dismissal of the DMCA section 1202(b) claim, and the case is back in the district court (as of November 9, 2026). The case is covered in Doe v. GitHub (Copilot).

Program Pages Named on This Page

The program terms above come from each program's own page, checked November 9, 2026.

• Avelence (intermediary)
• Mercor data buyer profile
• Pangea.ai (intermediary)
• SimpleClosure (intermediary)
• Troveo (intermediary)
• Turing Project Lazarus profile
• company data partnership programs and who buys AI training data

Frequently Asked Questions

Can a company sell its GitHub repositories to AI companies?

Yes, a company can license private repositories it owns, usually non-exclusively and with commit history, through data programs and intermediaries rather than an outright sale. Section D.3 keeps ownership with the customer, Pangea.ai and Turing state non-exclusive terms, and only SimpleClosure lists an outright sale (checked November 9, 2026).

How long does a GitHub organization export stay available?

GitHub deletes an organization migration archive automatically seven days after it is generated, so the export is made when a buyer or intermediary is ready to receive it. Deleting the organization removes the repositories themselves.

Does GitHub train AI on code hosted on GitHub?

GitHub's Terms give it a license that covers training AI models of GitHub and its Affiliates, and GitHub states it uses Copilot Free, Pro and Pro+ interaction data from April 24, 2026. The settings are covered in the opt-out guide linked above.

What is a GitHub repository worth to an AI buyer?

No public price exists for GitHub data as such; Pangea.ai, a marketplace, states indicative rates of USD 100 per million source tokens and USD 40 per million git-history tokens (checked November 9, 2026). Those rates are one marketplace's claim, not a price paid. The wider price record is in how much company data is worth to AI companies.