Learn
Some programs want engineering help from a model while source, infrastructure definitions and pipeline files stay in an account they already operate. That includes commercial teams and civilian and defense agencies. Topsoil was built with that in mind.
Last checked: November 2026.
GitHub Copilot is a strong choice for teams that live on GitHub. GitHub offers US data residency for Copilot, and for US government customers it routes requests to model hosts that are FedRAMP Moderate authorized. Copilot itself is not yet listed as FedRAMP authorized. GitHub has said that authorization will come through GitHub Enterprise Cloud with data residency, which the FedRAMP Marketplace still lists as not yet certified. A Copilot CLI can also run against GitHub Enterprise Server with a model provider you configure. GitHub’s changelog is the source for the data residency announcement.
Some programs look closely at where each hop runs and who operates it. One shape they choose is a client that calls Amazon Bedrock in the commercial or AWS GovCloud (US) account they already operate, with a person approving changes before they ship. Other tools reach similar goals in different ways, including services that already run in GovCloud and private installs you operate. Check each vendor’s current documentation. The roundup links several of them.
Topsoil is a client your team installs. It calls Amazon Bedrock in the account you already operate, and a person approves changes before they ship. The dated side-by-side is Topsoil and GitHub Copilot.
| Question | What to look for with Topsoil |
|---|---|
| Who operates the path | A client on your machine calling Amazon Bedrock in your commercial or AWS GovCloud (US) account. |
| Where prompts and source go | To the Bedrock, custom HTTPS or gateway endpoint you configure, and to the forge you already use. |
| Which forge receives the change | GitHub, self-managed GitLab, or Jira Data Center with Bitbucket Data Center. Bitbucket Cloud is not supported. |
| Who merges | A person. Topsoil opens the pull request or merge request and stops before approve and merge. |
| What the program still decides | Which Bedrock models to enable, which IAM identities may call them, and how the system is documented. Topsoil does not make a system compliant with any framework. |
Some programs keep source on a forge they run. Topsoil calls self-managed GitLab, or Jira Data Center with Bitbucket Data Center, with its own clients and no hosted relay. The branch lands on that forge. GitHub works the same way when that is where the code lives.
How the change is held on the way there is how engineering changes get approved. Design docs, application changes, Terraform or CloudFormation, and pipeline YAML are covered in software, infrastructure and pipeline work on Amazon Bedrock.
Your program decides how the system is documented. Questions about export-controlled source belong with your compliance lead, and they are gathered in export-controlled code.
Questions
No. It is a separate client that calls Amazon Bedrock in your own AWS account. It can open work on GitHub, self-managed GitLab, or Bitbucket Data Center. It is one option among others that can keep work in infrastructure you operate.
It is built for staged engineering work, from a design through a reviewed change. Many teams keep an editor assistant for keystrokes.
Yes. Topsoil calls Amazon Bedrock in your GovCloud account. Which models you can use depends on what AWS offers in GovCloud and what your account has enabled. Some third-party models are enabled through a separate AWS access step, and AWS publishes which models carry FedRAMP High and DoD IL4 and IL5 approval on its Bedrock scope page. Your program decides which models are approved. Setup across both GovCloud regions is on the GovCloud page.
Your program. You enable the Bedrock models the account allows, and Topsoil lists what that account can call. The list differs by region.
A pilot runs in your own AWS account, with your models and your material, and ends with findings you can act on.