{"object":"determination","schema_version":"1","vendor":"GitHub Copilot","state":"determined","sentence":"Contracts with GitHub, Inc. (United States) — within reach of US legal process.","qualifier":"Controlled by Microsoft Corporation (United States), per the vendor's own LEI filing, entity-supplied [2026-09-13].","contracting_entity":"GitHub, Inc.","jurisdiction":"United States","governing_law":"Two-branch region split on LAW ONLY, not on entity. Default: laws of the State of California and federal laws of the United States, with exclusive venue in the federal or state courts located in the Northern District of California. Carve-out: if Customer's principal office is within the European Union, European Economic Area, or Switzerland, the Agreement is instead governed by the laws of Ireland, with exclusive venue in the courts located in Dublin. Both branches contract with the same US entity, GitHub, Inc. The 1980 UN Convention on Contracts for the International Sale of Goods is excluded. (The older GitHub Corporate Terms of Service, a legacy base agreement still in force for some customers, uses an equivalent but differently-drawn split: Americas -> California law / N.D. Cal.; outside the Americas -> laws of Ireland / Dublin courts.)","conditions":["The agreement is under a governing law that depends on where the customer is based."],"us_control":{"status":"us_contracting_entity","finding":"Yes — a US parent or US contracting entity is on the public record","parent":{"name":"Microsoft Corporation","country":"United States","source_url":"https://api.gleif.org/api/v1/lei-records/6354003LMZZAKOPXLX69/direct-parent-relationship","read":"2026-09-13","citation":"controlled by Microsoft Corporation (United States), per the vendor's own LEI filing, entity-supplied [2026-09-13]"},"legal_reach":"The contracting entity is a US entity, so US law may have legal reach over it and the data it controls.","rule":"A provider subject to US jurisdiction can be required by valid US legal process to produce data in its possession, custody or control wherever it is located (CLOUD Act, 18 U.S.C. § 2713). A US-incorporated contracting entity is subject to US jurisdiction. A non-US contracting entity under US corporate control may be within reach through that control, depending on whether the parent controls the data and on the circumstances; where that control has not been established, the entity is not thereby beyond reach.","rule_url":"/static/manifesto.html#us-reach-rule"},"evidence":{"source_url":"https://assets.ctfassets.net/8aevphvgewt8/luAPHjODK4vAYIpwisJfC/88a1961a9c7fcbb8d02a86d5d4635295/GCA_-_2025_03_-_GitHub_Customer_Agreement_General_Terms_-_FINAL_locked.pdf","document_title":null,"date_read":"2026-09-16","last_rechecked":{"last_check":"found_again","gate":"held","date":"2026-09-17","words":"clause re-checked 17 Sep 2026"},"quote":null,"quote_carried_by":"the AI Subprocessor Jurisdiction Report ($299), which quotes the clause each finding rests on"},"not_established":[]}