> For the complete documentation index, see [llms.txt](https://docs.stepsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stepsecurity.io/resources/enterprise-readiness/ghes-and-ghec-data-residency-feature-parity.md). # GHES and GHEC Data Residency Feature Parity {% hint style="info" %} GHES support is disabled by default. [Contact us](https://www.stepsecurity.io/contact) to have it enabled for your tenant. For connectivity models and deployment steps, see [GitHub Enterprise Servers](/administration/admin-console/resources/github-enterprise-servers.md). If your enterprise is on GitHub Enterprise Cloud with data residency, [contact us](https://www.stepsecurity.io/contact) to scope onboarding for your `ghe.com` subdomain. {% endhint %} Most StepSecurity capabilities behave identically no matter where your repositories live: GitHub Cloud, GitHub Enterprise Server (GHES), or [GitHub Enterprise Cloud with data residency](https://docs.github.com/en/enterprise-cloud@latest/admin/data-residency/about-github-enterprise-cloud-with-data-residency) (referred to on this page as GHEC DR, where your enterprise is hosted on a dedicated subdomain of `ghe.com`). A small number of capabilities are not yet available outside GitHub Cloud, and the same set is unavailable on GHES and on GHEC DR today. This page lists which capabilities are available on those two platforms so you can plan a migration, or scope a deployment, without discovering gaps mid-rollout. {% hint style="info" %} StepSecurity is actively working to close the remaining gaps listed below. If a specific capability is blocking your rollout, [contact us](https://www.stepsecurity.io/contact) and we can share the current status for that capability. {% endhint %} ### Not affected by where your code is hosted The following product areas do not depend on where your repositories are hosted and behave the same on GHES and GHEC DR as on GitHub Cloud: * Dev Machine Guard, which reports from developer machines rather than from your Git host * Secure Registry, which proxies package registries rather than repositories ### Workspace | Capability | GitHub Cloud | GHES and GHEC DR | | -------------------------------------------- | ------------ | ---------------- | | [Overview](/workspace/overview.md) | Available | Available | | [Detections](/workspace/detections.md) | Available | Available | | [Threat Center](/workspace/threat-center.md) | Available | Available | | [Reports](/workspace/reports.md) | Available | Available | | [Settings](/workspace/settings.md) | Available | Available | ### GitHub Actions #### Harden-Runner | Capability | GitHub Cloud | GHES and GHEC DR | | ----------------------------------------------------------------------- | ------------ | ---------------- | | [Workflow Runs](/github-actions/harden-runner/workflow-runs.md) | Available | Available | | [Baseline](/github-actions/harden-runner/baseline.md) | Available | Available | | [Suppression Rules](/github-actions/harden-runner/suppression-rules.md) | Available | Available | | [Policy Store](/github-actions/harden-runner/policy-store.md) | Available | Available | {% hint style="info" %} Lockdown Mode is configured through the Policy Store but is available only for ARC (Kubernetes) clusters, on GitHub Cloud and GHES alike. Availability depends on your runner type, not on your Git host. {% endhint %} #### Actions | Capability | GitHub Cloud | GHES and GHEC DR | | --------------------------------------------------------------------------------------------- | ------------ | ---------------- | | [GitHub Actions In Use](/github-actions/actions/github-actions-in-use.md) | Available | Available | | [Reusable Workflows](/github-actions/actions/reusable-workflows.md) | Available | Available | | [GitHub Actions Advisor](/github-actions/actions/github-actions-advisor.md) | Available | Available | | [StepSecurity Maintained Actions](/github-actions/actions/stepsecurity-maintained-actions.md) | Available | Available | #### Actions Secret | Capability | GitHub Cloud | GHES and GHEC DR | | --------------------------------------------------- | ------------ | ---------------- | | [Actions Secret](/github-actions/actions-secret.md) | Available | Available | ### GitHub #### GitHub Checks | Check | GitHub Cloud | GHES and GHEC DR | | --------------------------------- | ------------ | ---------------- | | `npm Package Compromised Updates` | Available | Available | | `npm Package Cooldown` | Available | Available | | `PWN Request` | Available | Not available | | `Script Injection` | Available | Not available | For what each check does and how to configure it, see [Configuration.](/github/github-checks/configuration.md) #### Orchestrate Security | Capability | GitHub Cloud | GHES and GHEC DR | | ---------------------------------------------------------------------- | ------------ | ---------------- | | [Secure Workflow](/github/orchestrate-security/secure-workflow.md) | Available | Available | | [Policy-Driven PRs](/github/orchestrate-security/policy-driven-prs.md) | Available | Not available | | [Pull Requests](/github/orchestrate-security/pull-requests.md) | Available | Not available | | [Secure Repo](/github/orchestrate-security/secure-repo.md) | Available | Not available | #### Apps & PATs | Capability | GitHub Cloud | GHES and GHEC DR | | --------------------------------------- | ------------ | ---------------- | | [Apps & PATs](/github/apps-and-pats.md) | Available | Not available | ### Packages #### OSS Package Search | Capability | GitHub Cloud | GHES and GHEC DR | | ----------------------------------------------------- | ------------ | ---------------- | | [OSS Package Search](/packages/oss-package-search.md) | Available | Available | OSS Package Search currently covers the npm, PyPI, Maven, and NuGet ecosystems, and searches pull requests, default branches, and developer machines. Ecosystem coverage is the same on all three platforms. For the current list of ecosystems and the dependency and lock files inspected for each, see [OSS Package Search](/packages/oss-package-search.md). ### Planning a migration or rollout If you are moving from GitHub Cloud to GHES or to GHEC DR, the capabilities marked **Not available** above are the ones to plan around. In practice that means: * **Automated remediation pull requests are not available.** Policy-Driven PRs, Pull Requests, and Secure Repo all work by opening pull requests against your repositories. Secure Workflow remains available on both platforms, so you can still generate hardened workflow files, but applying them becomes a manual step. * **Two workflow-vulnerability checks do not run.** `PWN Request` and `Script Injection` are unavailable. The package supply-chain checks continue to run, so dependency risk stays covered. * **Apps & PATs inventory is unavailable**, so GitHub App and personal access token inventory will not be part of your posture reporting on these platforms. Everything else in the tables above carries over unchanged, including Harden-Runner runtime monitoring, egress policy enforcement through the Policy Store, Actions inventory and advisory, and the full Workspace surface. As noted above, these gaps are being actively worked on. Check with your StepSecurity representative before you assume a capability in this list will still be missing at the time of your rollout. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.stepsecurity.io/resources/enterprise-readiness/ghes-and-ghec-data-residency-feature-parity.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.