Skip to main content
AI Governance
Rule Watch™

Vendor Privacy Scorecard · Microsoft

Microsoft 365 Copilot: is it safe for client information?

AI built into Word, Outlook, Teams and Excel. On a business Microsoft 365 account it stays inside your existing Microsoft data protections.

Strong on business plans

Bottom line

One of the strongest options for licensed offices already on business Microsoft 365. The free consumer Copilot app is a different product with consumer terms.

Does it train on your data? By plan

  • Consumer Copilot (personal Microsoft account): User or admin setting

    Consumer terms. Users can opt out of model training in settings.

  • Microsoft 365 Copilot (work account): No training

    Prompts and files are not used to train foundation models and stay within your tenant boundary.

  • Copilot Chat with work sign-in: No training

    Enterprise data protection applies when signed in with a work account.

What an auditor will ask

Trains AI on your data? No
Work accounts: not used for training. Consumer Copilot is different.
Retention you can control? Yes
Follows your Microsoft 365 retention and eDiscovery policies, which admins control.
Signs a HIPAA BAA? Yes
Covered by Microsoft's HIPAA BAA through the Product Terms for eligible business plans.
Staff may read your content? No
Work content is not reviewed by Microsoft staff except under your existing service terms.

Security certifications

  • SOC 2 Type II
  • ISO/IEC 27001
  • ISO/IEC 27018
  • ISO/IEC 42001
  • FedRAMP (government clouds)

Set it up the safe way

  1. Make sure staff sign in with their work account, not a personal Microsoft account.
  2. Check your Microsoft 365 permissions so Copilot cannot surface files people should not see.
  3. Confirm the Microsoft BAA covers your plan if you handle health information.
  4. Record who approved Copilot and the date.

Microsoft trust centerBusiness privacy terms

Summarized from Microsoft's published terms, last checked 10/1/2026. Vendors change terms. Confirm every point against the agreement you actually signed. This is not legal advice.

See every vendor scorecard

Using Microsoft 365 Copilot at work? An unvetted tool can cost you your license.

When an employee pastes client information or confidential files into Microsoft 365 Copilot without the correct safeguards, licensing boards and regulatory bodies hold you responsible. AI Governance Rule Watch™ documents your approved tool roster, vendor reviews, and staff guidelines in permanent diligence records ready for any audit.

Protect my business for $67/month Or $670/year · 2 months free

Founding member rate. Cancel anytime. Plus applicable taxes. Renews until canceled. Not legal advice and not a compliance certification.