COPILOT AUDIT · AI ACT ART. 26 · NIS2 · BETA

Prove that your Copilot rollout is in order — without writing a second DPIA.

We pull seat usage + audit log from GitHub's own admin API, hash usernames at ingest, and bundle it monthly into an Ed25519-signed evidence pack. For when compliance or HR asks: 'who has Copilot, when activated, last used when, what settings changed, by whom?'

Open in dashboard →Setup guide

Why this is needed

Under AI Act art. 26 you're a 'deployer' of a general-purpose AI — Copilot.

If your company has Copilot Business or Enterprise, GitHub is the 'provider' of the AI system (they built the model), but YOU are the 'deployer' (you're rolling it out to your employees). Art. 26 puts obligations on deployers:

Inform employees that their work is AI-assisted (art. 26 §7).
Keep a logbook of significant usage — not every autocomplete, but seat assignments, policy changes, deactivations (art. 26 §6).
Periodically assess whether usage is still in line with the provider's instructions.
On a serious incident: report within 15 days (art. 26 §5 refers to art. 73).

We provide the logging input. You remain responsible for the judgement.

How it works

One PAT, one click, first data within an hour.

Mint a GitHub PAT

github.com → Settings → Developer settings → Fine-grained tokens. Scopes: manage_billing:copilot · read:audit_log · read:org. 90-day expiry (we warn 7 days before).

Paste into monsys

Dashboard → Copilot Audit → '+ Connect org'. We verify the token works immediately (HTTP probe on /orgs/{org}). PAT is AES-256-GCM encrypted before insert — not retrievable via API afterwards.

First pull within 1 hour

Our worker runs hourly: pull all seats (snapshot), pull new audit events (cursor pagination, only 'action:copilot.*'). Usernames are SHA256-hashed; only a 4-char prefix is kept for display.

Monthly evidence pack

On the 1st of each month, download a signed evidence pack — gzipped tarball with seats.jsonl + events.jsonl + manifest.json + manifest.sig. Verifiable offline by your auditor, same tool as for AI observability.

What we keep and don't keep

Privacy by default. Hashed by default.

KEPT

SHA256 hash of GitHub username (deterministic — same user → same hash)
First 4 chars of username + '…' for display (jan…)
Plan type (business / enterprise), assigning team, editor (VSCode/JetBrains), last activity timestamp
Audit-event type, occurred_at, filtered payload (no PII fields)

NOT KEPT

Full username, email address, display name — dropped at ingest
Code suggestions, prompts, completions — Copilot keeps those, not us
IP addresses — not in GitHub's admin API
Files a dev had open — private to the dev, not in the audit log

Pricing

€1 per seat per month. Fair and linear.

Based on average seat count over the month (daily snapshot, averaged). Tenant with no connected org pays nothing. No need for the 'Standard' tier of AI observability — Copilot Audit is a separate add-on.

Example: 30 seats in January, 35 in February → invoice Jan €30, Feb €35.

Billed monthly on the same Stripe invoice as your server monitoring + AI observability. Separate line item 'monsys.ai Copilot Audit — N seats × €1.00'.

Open dashboard →Full setup guide in docs