GHES and GHEC Data Residency Feature Parity

GHES support is disabled by default. Contact us to have it enabled for your tenant. For connectivity models and deployment steps, see GitHub Enterprise Servers.

If your enterprise is on GitHub Enterprise Cloud with data residency, contact us to scope onboarding for your ghe.com subdomain.

Most StepSecurity capabilities behave identically no matter where your repositories live: GitHub Cloud, GitHub Enterprise Server (GHES), or GitHub Enterprise Cloud with data residency (referred to on this page as GHEC DR, where your enterprise is hosted on a dedicated subdomain of ghe.com). A small number of capabilities are not yet available outside GitHub Cloud, and the same set is unavailable on GHES and on GHEC DR today.

This page lists which capabilities are available on those two platforms so you can plan a migration, or scope a deployment, without discovering gaps mid-rollout.

StepSecurity is actively working to close the remaining gaps listed below. If a specific capability is blocking your rollout, contact us and we can share the current status for that capability.

Not affected by where your code is hosted

The following product areas do not depend on where your repositories are hosted and behave the same on GHES and GHEC DR as on GitHub Cloud:

• Dev Machine Guard, which reports from developer machines rather than from your Git host
• Secure Registry, which proxies package registries rather than repositories

Workspace

Capability	GitHub Cloud	GHES and GHEC DR
Overview	Available	Available
Detections	Available	Available
Threat Center	Available	Available
Reports	Available	Available
Settings	Available	Available

GitHub Actions

Harden-Runner

Capability	GitHub Cloud	GHES and GHEC DR
Workflow Runs	Available	Available
Baseline	Available	Available
Suppression Rules	Available	Available
Policy Store	Available	Available

Lockdown Mode is configured through the Policy Store but is available only for ARC (Kubernetes) clusters, on GitHub Cloud and GHES alike. Availability depends on your runner type, not on your Git host.

Actions

Capability	GitHub Cloud	GHES and GHEC DR
GitHub Actions In Use	Available	Available
Reusable Workflows	Available	Available
GitHub Actions Advisor	Available	Available
StepSecurity Maintained Actions	Available	Available

Actions Secret

Capability	GitHub Cloud	GHES and GHEC DR
Actions Secret	Available	Available

GitHub

GitHub Checks

Check	GitHub Cloud	GHES and GHEC DR
npm Package Compromised Updates	Available	Available
npm Package Cooldown	Available	Available
PWN Request	Available	Not available
Script Injection	Available	Not available

For what each check does and how to configure it, see Configuration.

Orchestrate Security

Capability	GitHub Cloud	GHES and GHEC DR
Secure Workflow	Available	Available
Policy-Driven PRs	Available	Not available
Pull Requests	Available	Not available
Secure Repo	Available	Not available

Apps & PATs

Capability	GitHub Cloud	GHES and GHEC DR
Apps & PATs	Available	Not available

Packages

OSS Package Search

Capability	GitHub Cloud	GHES and GHEC DR
OSS Package Search	Available	Available

OSS Package Search currently covers the npm, PyPI, Maven, and NuGet ecosystems, and searches pull requests, default branches, and developer machines. Ecosystem coverage is the same on all three platforms. For the current list of ecosystems and the dependency and lock files inspected for each, see OSS Package Search.

Planning a migration or rollout

If you are moving from GitHub Cloud to GHES or to GHEC DR, the capabilities marked Not available above are the ones to plan around. In practice that means:

• Automated remediation pull requests are not available. Policy-Driven PRs, Pull Requests, and Secure Repo all work by opening pull requests against your repositories. Secure Workflow remains available on both platforms, so you can still generate hardened workflow files, but applying them becomes a manual step.
• Two workflow-vulnerability checks do not run. PWN Request and Script Injection are unavailable. The package supply-chain checks continue to run, so dependency risk stays covered.
• Apps & PATs inventory is unavailable, so GitHub App and personal access token inventory will not be part of your posture reporting on these platforms.

Everything else in the tables above carries over unchanged, including Harden-Runner runtime monitoring, egress policy enforcement through the Policy Store, Actions inventory and advisory, and the full Workspace surface.

As noted above, these gaps are being actively worked on. Check with your StepSecurity representative before you assume a capability in this list will still be missing at the time of your rollout.