But it has to use your code for inferencing, doesn't it? So it is sending it to someone.

I see this being a blocker at a lot of places. I know in my workplace the infosec people are apoplectic about it and we supposedly have a 'partnership' with OpenAI.

You're not wrong, and I realize there is nuance here, but if you're using GitHub you are already sending your code to Microsoft.

I don't think using GitHub is a prerequisite for using Copilot but I could be wrong.

Do those places use GitHub? Anything on GitHub has been given to Microsoft.

Not like Microsoft has ever lied or breached trust