Security and Privacy of Copilot Chat OTel data
mainCopilot Chat's OpenTelemetry implementation follows these security principles:
- Off by default: No OTel data is emitted unless
github.copilot.chat.otel.enabledis set totrue. When disabled, the SDK is not loaded, ensuring zero runtime overhead. - No content by default: Prompts, responses, and tool arguments are only captured if
github.copilot.chat.otel.captureContentis explicitly enabled. - No PII in default attributes: Default attributes like session IDs, model names, and token counts do not contain personally identifiable information.
- User-controlled endpoints: Data is only sent to the endpoint explicitly configured by the user.
- Dynamic imports: OTel SDK packages are loaded on-demand to ensure zero bundle impact when telemetry is disabled.